CVE-2019-10238

Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter...

CVE-2019-10238

CVE-2019-10238 concerns Sitemagic CMS v4.4, where an XSS flaw exists in SMFiles/FrmUpload.class.php through the filename parameter. The vulnerability description across connected sources consistently identifies a cross-site scripting issue exploitable via the filename field in FrmUpload.class.php...

PT-2019-11650

Name of the Vulnerable Software and Affected Versions: Sitemagic CMS version 4.4 Description: The issue concerns a security problem where an attacker can inject malicious code. This is achieved through the filename parameter in the SMFiles/FrmUpload.class.php file. Recommendations: For Sitemagic...

CVE-2019-10238: Improper Neutralization of Input During Web Page Generation

Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter...

CVE-2019-9042

An issue was discovered in Sitemagic CMS v4.4. In the index.php?SMExt=SMFiles URI, the user can upload a .php file to execute arbitrary code, as demonstrated by 404.php. This can only occur if the administrator neglects to set FileExtensionFilter and there are untrusted user accounts. NOTE: The...

CVE-2019-9042: Unrestricted Upload of File with Dangerous Type

An issue was discovered in Sitemagic CMS v4.4. In the index.php?SMExt=SMFiles URI, the user can upload a .php file to execute arbitrary code, as demonstrated by 404.php. This can only occur if the administrator neglects to set FileExtensionFilter and there are untrusted user accounts. NOTE: The...

PT-2019-19331 · Sitemagic · Sitemagic Cms

Name of the Vulnerable Software and Affected Versions: Sitemagic CMS version 4.4 Description: An issue in the index.php?SMExt=SMFiles URI allows users to upload .php files, potentially executing arbitrary code, as shown with 404.php. This issue can only occur if the administrator fails to set the...