CVE-2015-8032

In Textpattern 4.5.7, an unprivileged author can change an article's markup setting...

CVE-2015-8032

CVE-2015-8032 affects Textpattern 4.5.7. The vulnerability allows an unprivileged author to change an article's markup setting, indicating a permission/ownership flaw in how article markup is managed. The provided sources do not specify an exploit method or a patch/mitigation. The impact is limit...

CVE-2015-8032: Improper Privilege Management

In Textpattern 4.5.7, an unprivileged author can change an article's markup setting...

CVE-2015-8033: Weak Password Requirements

In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account...

File upload vulnerability in tx***_fi***.php file in TextpatternCMS backend

TextpatternCMS is a content management system written in PHP. A file upload vulnerability exists in the txfi.php file in the backend of TextpatternCMS. It allows an attacker to upload a webshell and gain server privileges...

SQL Code Injection

textpattern/lock is vulnerable to SQL injection. The attacker can launch the attack via the "qty" on the page index.php with authentication as administrator...

Textpattern CMS 'qty' SQL Injection Vulnerability

Textpattern CMS is an open source content management system CMS developed by the Textpattern team. The system supports creating, editing and publishing content. A SQL injection vulnerability exists in Textpattern CMS 4.6.2 and earlier versions. A remote attacker can use the 'qty' parameter on the...

textpattern denial of service vulnerability

textpattern is an excellent blogging system. A security vulnerability exists in the Import XML feature in textpattern version 4.6.2. An attacker can exploit this vulnerability by uploading a specially crafted XML file to cause a denial of service exhaustion of server memory resources...

CVE-2018-7474

An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php...

Code injection

An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php...

CVE-2018-7474

An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php...

CVE-2018-7474

Summary (validated by multiple sources): Textpattern CMS 4.6.2 and earlier is vulnerable to SQL injection through the value of the qty parameter on the index.php page. The vulnerability is exploitable in contexts where an attacker with administrator-facing access can trigger the flaw, potentially...

CVE-2018-7474

An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php...

CVE-2018-7474: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php...

CVE-2018-1000090

textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web server by exhausting server memory resources. This attack appear to be exploitable via Uploading a specially crafted XML file...

CVE-2018-1000090

textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web server by exhausting server memory resources. This attack appear to be exploitable via Uploading a specially crafted XML file...

Design/Logic Flaw

textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web server by exhausting server memory resources. This attack appear to be exploitable via Uploading a specially crafted XML file...

CVE-2018-1000090

textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web server by exhausting server memory resources. This attack appear to be exploitable via Uploading a specially crafted XML file...

CVE-2018-1000090

CVE-2018-1000090 affects Textpattern 4.6.2, where the Import XML feature is vulnerable to an XML Injection that can cause a Denial of Service by exhausting server memory. The exploit is described as uploading a specially crafted XML file; exploitation status is noted in sources, but there are no ...

Textpattern 4.6.2 SQL Injection

============================================= MGC ALERT 2018-002 - Original release date: February 12, 2018 - Last revised: March 12, 2018 - Discovered by: Manuel GarcAa CA!rdenas - Severity: 7,1/10 CVSS Base Score - CVE-ID: CVE-2018-7474 ============================================= I...