CVE-2021-36545

The CVE-2021-36545 entry refers to a Cross-Site Scripting (XSS) vulnerability in tpcms version 3.2 where the cfg_copyright and cfg_tel fields in the Site Configuration page can be exploited to run arbitrary code remotely. Affected software: tpcms 3.2; vulnerable component: Site Configuration inpu...

CVE-2021-36545

Cross Site Scripting XSS vulnerability in tpcms 3.2 allows remote attackers to run arbitrary code via the cfgcopyright or cfgtel field in Site Configuration page...

CVE-2021-36544

Incorrect Access Control issue discovered in tpcms 3.2 allows remote attackers to view sensitive information via path in application URL...

PT-2023-12287 · Tpcms · Tpcms

Name of the Vulnerable Software and Affected Versions: tpcms version 3.2 Description: An issue with access control in the application allows remote attackers to view sensitive information by manipulating the path in the application URL. Recommendations: For tpcms version 3.2, consider restricting...

CVE-2021-36544

CVE-2021-36544 describes an access-control vulnerability in tpcms 3.2 where remote attackers can view sensitive information by manipulating the URL path. Multiple connected documents (NVD, Red Hat, CNVD, CNVD-derived references, and related catalogs) consistently identify it as an improper access...

TPCMS arbitrary file upload vulnerability

TPCMS, an open source content management system from the individual developers of Source of Happiness, is vulnerable to an arbitrary file upload vulnerability in version v3.2, which stems from a lack of validation of uploaded files by the application. An attacker could exploit this vulnerability ...

CVE-2022-29624

An arbitrary file upload vulnerability in the Add File function of TPCMS v3.2 allows attackers to execute arbitrary code via a crafted PHP file...

Design/Logic Flaw

An arbitrary file upload vulnerability in the Add File function of TPCMS v3.2 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-29624

TPCMS v3.2 contains an arbitrary file upload vulnerability in the Add File function that can allow an attacker to execute arbitrary PHP code via a crafted file. The issue stems from insufficient validation of uploaded files, enabling remote code execution. Affected product: TPCMS 3.2 (open‑source...

CVE-2022-29624

An arbitrary file upload vulnerability in the Add File function of TPCMS v3.2 allows attackers to execute arbitrary code via a crafted PHP file...

TPCMS Cross-Site Scripting Vulnerability (CVE-2022-27441)

TPCMS is a content management system.A cross-site scripting vulnerability exists in TPCMS version 3.2, which stems from the lack of proper validation of client-side data by the WEB application. An attacker could exploit the vulnerability to execute arbitrary web script or HTML by injecting a...

CVE-2022-27442

TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and password...

CVE-2022-27442

TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and password...

CVE-2022-27442

TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and password...

CVE-2022-27441

A stored cross-site scripting XSS vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Phone text box...

CVE-2022-27441

A stored cross-site scripting XSS vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Phone text box...

Cross site scripting

A stored cross-site scripting XSS vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Phone text box...

CVE-2022-27441

A stored cross-site scripting XSS vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Phone text box...

CVE-2022-27442

TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and password...

CVE-2022-27442

The CVE-2022-27442 entry concerns TPCMS v3.2, where attackers can access the ThinkPHP log directory and obtain sensitive information such as the administrator’s username and password. The available connected documents confirm the affected software (TPCMS v3.2), the vulnerable component (ThinkPHP ...