CVE-2019-14240

WCMS v0.3.2 has a CSRF vulnerability, with resultant directory traversal, to modify index.html via the /wex/html.php?finish=../index.html URI...

Design/Logic Flaw

WCMS v0.3.2 has a CSRF vulnerability, with resultant directory traversal, to modify index.html via the /wex/html.php?finish=../index.html URI...

CVE-2019-14240

WCMS v0.3.2 has a CSRF vulnerability, with resultant directory traversal, to modify index.html via the /wex/html.php?finish=../index.html URI...

CVE-2019-14240

Summary: WCMS v0.3.2 contains a CSRF vulnerability that enables directory traversal to modify the homepage (index.html) via the URI /wex/html.php?finish=../index.html. The issue resides in the web editor component (wex/html.php) and does not require authentication, enabling potential unauthorized...

CVE-2019-14240: Improper Limitation of a Pathname to a Restricted Directory

WCMS v0.3.2 has a CSRF vulnerability, with resultant directory traversal, to modify index.html via the /wex/html.php?finish=../index.html URI...

CVE-2019-11377

wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is a valid extension according to the fmgettextexts function...

Privilege escalation

wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is a valid extension according to the fmgettextexts function...

CVE-2019-11377

wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is a valid extension according to the fmgettextexts function...

CVE-2019-11377

CVE-2019-11377 affects WCMS v0.3.2: wcms/wex/finder/action.php is vulnerable to Arbitrary File Upload via developer/finder because .php is allowed by fm_get_text_exts. Root cause: PHP extension allowed for uploads. Impact details are provided in the connected records, with CVSS2/3 metrics (6.5/8....

CVE-2019-11377

wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is a valid extension according to the fmgettextexts function...

CVE-2019-11377: Unrestricted Upload of File with Dangerous Type

wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is a valid extension according to the fmgettextexts function...

Threat Outbreak Alert RuleID33043: Email Messages Distributing Malicious Software on June 22, 2018

Medium Alert ID: 58278 First Published: 2018 June 22 20:20 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID33043 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID32711: Email Messages Distributing Malicious Software on May 8, 2018

Medium Alert ID: 57820 First Published: 2018 May 8 14:59 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID32711 may contain the following files: Name | Size ...

Wonder CMS 2.3.1 - Unrestricted File Upload

Affected Code: public static function uploadFile + - if ! wCMS::$loggedIn && ! isset$FILES'uploadFile' && ! isset$REQUEST'token' return; + private static function uploadFileAction - if isset$REQUEST'token' && $REQUEST'token' == wCMS::generateToken && isset$FILES'uploadFile' Proof of Concept Steps...

SQL Injection Vulnerability in WCMS AnonymousController.php File

WCMS is a CMS for editors, an editor-oriented editor. A SQL injection vulnerability exists in the WCMS AnonymousController.php file. The vulnerability is due to the system failing to effectively filter user-submitted data. An attacker can exploit this vulnerability to obtain sensitive database...

DotCMS 3.3 SQL Injection

1¡¢Description Exploit Title: SQL Injection Vulnerability in DotCms v3.3 Date: 3-28-2016 Vendor Homepage: http://dotcms.com/ Vendor: dotcms Software: Content Management System Version: v3.3 CVE:CVE-2016-3688 2¡¢Product Summary ================ dotcms is a fully featured open source enterprise gra...

CMS PHPKit WCMS 1.6.6 Cross Site Scripting

Advisory: Reflecting XSS vulnerability in CMS PHPKit WCMS v. 1.6.6 Advisory ID: SROEADV-2014-07 Author: Steffen Rösemann Affected Software: CMS PHPKit WCMS v. 1.6.6 Build: 1660014 Vendor URL: http://www.phpkit.com/de/ Vendor Status: did not respond to issue CVE-ID: - ==========================...

PHPKIT WCMS 'include.php' cross-site scripting vulnerability

PHPKIT WCMS is a web-based content management system CMS. The system provides modules such as forums and message boards. A cross-site scripting vulnerability exists in PHPKIT WCMS, which stems from the program failing to adequately filter user-submitted input. When a user browses the affected sit...

php wcms XT 0.0.7 - Multiple Remote File Inclusion Vulnerabilities

No description provided by source. ?????????? ??????????????? ??????????????????? ??????????????????????? ?????????????????????????? ?????????????????????????????? ????????????????????????????????? ??????????????????????????????????? ?????????????????????????????????????...

WCMS 1.0b Arbitrary Add Admin Exploit

No description provided by source. !/usr/bin/perl ================================================= WCMS v.1.0b Arbitrary Add Admin Exploit ================================================= ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team...