Plone 跨站脚本漏洞

Plone is an open source content management system CMS built on the Zope application server. A cross-site scripting vulnerability exists in Plone version 5.2.3, which stems from the form.widgets.sitetitle parameter not effectively filtering user input, and can be exploited by an attacker to inject...

Plone CMS 5.2.3 - (Title) Stored XSS Vulnerability

Exploit Title: Plone CMS 5.2.3 - 'Title' Stored XSS Exploit Author: Piyush Patil Vendor Homepage: https://plone.com/ Software Link: https://github.com/plone/Products.CMFPlone/tags Version: 5.2.3 Tested on: Windows 10 Reference - https://github.com/plone/Products.CMFPlone/issues/3255 Steps to...

Cross site scripting

Typesetter CMS 5.x through 5.1 allows admins to conduct Site Title persistent XSS attacks via an Admin/Configuration URI. NOTE: the significance of this report is disputed because "admins are considered trustworthy...

CVE-2020-35126

Typesetter CMS 5.x through 5.1 allows admins to conduct Site Title persistent XSS attacks via an Admin/Configuration URI. NOTE: the significance of this report is disputed because "admins are considered trustworthy...

CVE-2020-35126: Improper Neutralization of Input During Web Page Generation

Typesetter CMS 5.x through 5.1 allows admins to conduct Site Title persistent XSS attacks via an Admin/Configuration URI. NOTE: the significance of this report is disputed because "admins are considered trustworthy...

OOP CMS BLOG 1.0 - Multiple Cross-Site Request Forgery

OOP CMS BLOG 1.0 - Multiple Cross-Site Request Forgery Exploit Title: OOP CMS BLOG 1.0 - Cross-Site Request Forgery Delete Admin Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: March 1, 2019 Vendor Homepage: http://zsoft.com.bd/ Software Link :...

OOP CMS BLOG 1.0 - Multiple Cross-Site Request Forgery

Exploit Title: OOP CMS BLOG 1.0 - Cross-Site Request Forgery Delete Admin Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: March 1, 2019 Vendor Homepage: http://zsoft.com.bd/ Software Link :...

OOP CMS BLOG 1.0 Cross Site Request Forgery / SQL Injection

Exploit Title: OOP CMS BLOG 1.0 - SQL Injection Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: March 1, 2019 Vendor Homepage: http://zsoft.com.bd/ Software Link : https://datapacket.dl.sourceforge.net/project/php-oop-cms-blog/blogforup.zip Tested Version: 1.0...

Subrion CMS Cross-Site Scripting Vulnerability (CNVD-2018-25034)

Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A cross-site scripting vulnerability exists in Subrion CMS version 4.2.1. A remote attacker can exploit th...

CVE-2018-16631

Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter...

Design/Logic Flaw

Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter...

CVE-2018-16631

Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter...

CVE-2018-16631

Subrion CMS v4.2.1 contains a cross-site scripting flaw exploitable via the panel/configuration/general Site Title parameter. The underlying issue is an XSS vulnerability that could let an attacker inject arbitrary JavaScript into a victim’s browser, potentially compromising sessions or performin...

CVE-2018-16631

Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter...

CVE-2018-16631: Improper Neutralization of Input During Web Page Generation

Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter...

JPress Cross-Site Scripting Vulnerability

JPress is a set of blogging platform developed using the Java language. A cross-site scripting vulnerability exists in JPress version 1.0-rc.5, which can be exploited to inject arbitrary web script or HTML by sending the site name, site title, or site subtitle fields to the...

Cross site scripting

An issue was discovered in WeaselCMS v0.3.5. XSS exists via Site Language, Site Title, Site Description, and Site Keywords on the SETTINGS page...

WeaselCMS Cross-Site Scripting Vulnerability

WeaselCMS is a lightweight content management system CMS written in PHP. A cross-site scripting vulnerability exists in WeaselCMS version 0.3.5. A remote attacker can exploit this vulnerability to execute JavaScript code via the Site Language, Site Title, Site Description, and Site Keywords field...

CVE-2018-14877: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WeaselCMS v0.3.5. XSS exists via Site Language, Site Title, Site Description, and Site Keywords on the SETTINGS page...

Z-BlogPHP Cross-Site Scripting Vulnerability (CNVD-2018-10489)

Z-BlogPHP is an open source PHP-based blogging system developed by the Z-Blog community. A cross-site scripting vulnerability exists in the Site Title field of the Base Settings on the Site Settings in Z-BlogPHP version 1.5.2. A remote attacker can exploit this vulnerability to inject arbitrary w...