GHSA-WV23-PFJ7-2MJJ October/System authenticated file write leads to remote code execution

Impact Assuming an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in the template markup. Patches Issue has been patched in Build 473 and v1.1.6 Workarounds Apply...

CVE-2021-32650

October CMS is a self-hosted content management system CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.6, an attacker with access to the backend is able to execute PHP code by using the theme import feature. This will bypass the safe mode feature that prevents P...

CVE-2020-15165

Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor. The official maintainer of the package is recommending all users upgrade to v1.1.8 as soon as possible. For more information, review the referenced GitHu...

CVE-2020-15165

The CVE-2020-15165 entry concerns the Chameleon Mini Live Debugger Android package (Google Play) version 1.1.6-free, where sources or permissions may have been tampered by a malicious actor. Red Hat and OSV records cite the same vulnerability description; ENISA EUVD-2020-7239 notes malware in the...

CVE-2018-8957

CoverCMS v1.1.6 has XSS via the fourth input box to index.php, related to admina/mconfigs.inc.php...

Design/Logic Flaw

CoverCMS v1.1.6 has XSS via the fourth input box to index.php, related to admina/mconfigs.inc.php...

CVE-2018-8957

CVE-2018-8957 affects CoverCMS v1.1.6. The vulnerability is a Cross-Site Scripting (XSS) flaw exploitable via the fourth input box on index.php, linked to admina/mconfigs.inc.php. The affected component is the input handling on the administrative config interface; root cause is improper input san...

Vlinks 1.1.6 (id) Remote SQL Injection Vulnerability

Exploit for unknown platform in category web applications ==================================================== Vlinks 1.1.6 id Remote SQL Injection Vulnerability ==================================================== !x! Informations: Name : vlinks Download : http://www.vlinks.org/...