12397 matches found
CMS Made Simple 2.2.8 Remote Code Execution Exploit
An issue was discovered in CMS Made Simple version 2.2.8. In the module DesignManager in the files action.adminbulkcss.php and action.adminbulktemplate.php, with an unprivileged user with Designer permission, it is possible to reach an unserialize call with a crafted value in the m1allparms...
CMS Made Simple 2.2.8 Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'CMS Made Simple Authenticated RCE via object injection', 'Description' = %q An issue was discovered in CMS Made Simple 2.2.8. In the module...
Plataformatec Simple Form Input Validation Error Vulnerability
Plataformatec Simple Form is a form builder from Plataformatec Brazil. An input validation error vulnerability exists in Plataformatec Simple Form. The vulnerability originates from a network system or product that does not properly validate input data. Detailed vulnerability details are not...
WordPress Easy Digital Downloads Simple Shipping extension cross-site scripting vulnerability
WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Easy Digital Downloads EDD Simple Shipping extension is a digital product sales plugin used in it. A cross-site...
CVE-2015-9527
The Easy Digital Downloads EDD Simple Shipping extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...
CVE-2015-9527
The CVE-2015-9527 entry concerns the WordPress Easy Digital Downloads (EDD) Simple Shipping extension. A cross-site scripting (XSS) flaw exists due to misuse of add_query_arg, affecting EDD releases across multiple branches: 1.8.x before 1.8.7; 1.9.x before 1.9.10; 2.0.x before 2.0.5; 2.1.x befor...
CMS Made Simple <= 2.2.11 Cross-Site Scripting (XSS) Vulnerability
CMS Made Simple is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2019-4947 · Linux +6 · Linux Kernel +6
Name of the Vulnerable Software and Affected Versions: Linux kernel versions through 5.3.11 Description: The issue is related to a memory leak in the ipmi bmc register function, which can be triggered by causing the ida simple get function to fail. This can lead to a denial of service due to memo...
CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2019-36850)
CMS Made Simple CMSMS is an open source content management system CMS from the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in CMSMS versi...
Phorpiex Botnet Shifts Gears From Ransomware to Sextortion
A recent wide-scale campaign indicates that a decade-old botnet is shifting gears from distributing ransomware to delivering millions of sextortion threats to innocent recipients. Worse, researchers say that the botnet’s spam campaign can affect up to 27 million potential victims. The botnet,...
CVE-2019-17630
CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News Add Article" screen...
CVE-2019-17629
CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager upload images" screen...
CVE-2019-17630
CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News Add Article" screen...
CVE-2019-17629
CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager upload images" screen...
Design/Logic Flaw
CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News Add Article" screen...
Design/Logic Flaw
CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager upload images" screen...
CVE-2019-17629
CMS Made Simple (CMSMS) 2.2.11 is affected by a stored cross‑site scripting (XSS) flaw. An admin can inject malicious content via a crafted image filename in the file manager > upload images screen, which is stored and later rendered in the application. The root cause is not explicitly detaile...
CVE-2019-17629
CMS Made Simple CMSMS 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager upload images" screen...
CVE-2019-17630
CMS Made Simple (CMSMS) version 2.2.11 contains a stored XSS vulnerability that can be triggered by an admin submitting a crafted image filename on the News > Add Article screen. The issue appears to be tied to how image filenames are processed and stored, enabling script execution in the admi...