CVE-2020-24140

Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via the pagename parameter to wex/html.php. It can help identify open ports, local network hosts and execute command on local services...

Directory traversal

Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename parameter to wex/html.php...

CVE-2020-24138

Cross Site Scripting XSS vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to wex/html.php...

CVE-2020-24138

CVE-2020-24138 is a Cross Site Scripting (XSS) vulnerability in WCMS 0.3.2. The issue allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to wex/html.php. Connected sources (Red Hat, CNVD, NVD, OSV) all describe the same flaw in WCMS 0.3.2. No concrete explo...