CVE-2022-46020

WBCE CMS v1.5.4 can implement getshell by modifying the upload file type...

CVE-2022-46020

WBCE CMS v1.5.4 can implement getshell by modifying the upload file type...

CVE-2022-46020

WBCE CMS v1.5.4 is affected by CVE-2022-46020, a remote code execution vulnerability caused by allowing getshell via modification of the upload file type. The NVD/Nuclei and related sources describe a critical flaw (CVSS v3.1: 9.8) with network attack vector, no privileges required, and high impa...

CVE-2022-45040

A cross-site scripting XSS vulnerability in /admin/pages/sectionssave.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name Section field...

CVE-2022-45039

An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-45036

A cross-site scripting XSS vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the No Results field...

CVE-2022-45038

A cross-site scripting XSS vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field...

Cross site scripting

A cross-site scripting XSS vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field...

Cross site scripting

A cross-site scripting XSS vulnerability in /admin/pages/sectionssave.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name Section field...

Cross site scripting

A cross-site scripting XSS vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the No Results field...

CVE-2022-45037

A cross-site scripting XSS vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field...

CVE-2022-45038

A cross-site scripting XSS vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field...

CVE-2022-45039

An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary code via a crafted PHP file...

PT-2022-27386 · Wbce Cms · Wbce Cms

Name of the Vulnerable Software and Affected Versions: WBCE CMS version 1.5.4 Description: A cross-site scripting XSS issue in the /admin/pages/sections save.php file allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name Section field. This can lea...

CVE-2022-45040

WBCE CMS v1.5.4 is affected by a cross-site scripting (XSS) issue in /admin/pages/sections_save.php. The vulnerability allows an attacker to inject arbitrary web scripts or HTML via the Name Section field, resulting in code execution in the victim’s browser. The provided documents describe the af...

CVE-2022-45037

WBCE CMS v1.5.4 contains a stored cross-site scripting (XSS) vulnerability in /admin/users/index.php. The issue allows an attacker to inject arbitrary web scripts or HTML via the Display Name field, potentially leading to execution in pages viewed by other users. Nuclei templates label this as St...

CVE-2022-45037

A cross-site scripting XSS vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field...

CVE-2022-45038

WBCE CMS v1.5.4 suffers a stored XSS in /admin/settings/save.php, exploitable via a crafted payload in the Website Footer field. Impact described: arbitrary script execution in users' browsers, with risks such as data theft, session hijacking, or page defacement. Affected component: admin/setting...

CVE-2022-45036

A cross-site scripting XSS vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the No Results field...

WBCE CMS 代码问题漏洞

WBCE CMS is an open source content management system CMS based on PHP and MySQL. A security vulnerability exists in WBCE CMS v1.5.4, which originates from an arbitrary file upload vulnerability in the server settings module. An attacker can exploit this vulnerability to execute arbitrary code via...