224 matches found
CVE-2020-24140
CVE-2020-24140 describes an SSRF in WCMS version 0.3.2. An attacker can craft requests via the pagename parameter to wex/html.php from the vulnerable web application’s back-end server, enabling discovery of open ports and local network hosts and the execution of commands on local services. The co...
CVE-2020-24140
Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via the pagename parameter to wex/html.php. It can help identify open ports, local network hosts and execute command on local services...
CVE-2020-24139
CVE-2020-24139 affects WCMS/Wcms 0.3.2, exposing a server‑side request forgery (SSRF) in the wex/cssjs.php path parameter. The described impact is that an attacker can issue crafted requests from the vulnerable web application's back end to identify open ports and local network hosts and may exec...
CVE-2020-24139
Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application via the path parameter to wex/cssjs.php. It can help identify open ports, local network hosts and execute command on local services...
CVE-2020-24135
CVE-2020-24135 is a reflected XSS vulnerability in WCMS version 0.3.2. The issue arises in the wex/cssjs.php handler where the attacker can supply a crafted value for the type parameter to inject arbitrary web script/HTML. This vulnerability is documented across multiple sources (e.g., Red Hat, C...
CVE-2020-24135
A Reflected Cross Site Scripting XSS Vulnerability was discovered in Wcms 0.3.2, which allows remote attackers to inject arbitrary web script and HTML via the type parameter to wex/cssjs.php...
CVE-2020-24136
Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename parameter to wex/html.php...
CVE-2020-24136
CVE-2020-24136 affects WCMS version 0.3.2. The vulnerability is a directory traversal in the media path exposed by the pagename parameter to wex/html.php, allowing an attacker to read arbitrary files on the server running the application. The issue is documented consistently across multiple conne...
CVE-2020-24138
CVE-2020-24138 is a Cross Site Scripting (XSS) vulnerability in WCMS 0.3.2. The issue allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to wex/html.php. Connected sources (Red Hat, CNVD, NVD, OSV) all describe the same flaw in WCMS 0.3.2. No concrete explo...
CVE-2020-24138
Cross Site Scripting XSS vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to wex/html.php...
CVE-2020-24139: Server-Side Request Forgery (SSRF)
Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application via the path parameter to wex/cssjs.php. It can help identify open ports, local network hosts and execute command on local services...
CVE-2020-24137: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the path parameter to wex/cssjs.php...
CVE-2020-24135: Improper Neutralization of Input During Web Page Generation
A Reflected Cross Site Scripting XSS Vulnerability was discovered in Wcms 0.3.2, which allows remote attackers to inject arbitrary web script and HTML via the type parameter to wex/cssjs.php...
CVE-2020-24140: Server-Side Request Forgery (SSRF)
Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via the pagename parameter to wex/html.php. It can help identify open ports, local network hosts and execute command on local services...
CVE-2020-24138: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to wex/html.php...
Wcms 代码问题漏洞
WCMS is a content management system CMS that uses an open web interface to build websites. A server-side request forgery vulnerability exists in WCMS version 0.3.2. An attacker can send a specially crafted request from the web application's back-end server via the path parameter of wex/cssjs.php,...
CVE-2020-24136: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename parameter to wex/html.php...
Wcms 代码问题漏洞
WCMS is a content management system CMS. A server-side request forgery vulnerability exists in Wcms version 0.3.2, where an attacker sends a crafted request/html.php file to wex from the back-end server of a vulnerable web application via the pagename parameter. It can help to identify open ports...
