CVE-2020-24140

Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via the pagename parameter to wex/html.php. It can help identify open ports, local network hosts and execute command on local services...

Directory traversal

Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename parameter to wex/html.php...

CVE-2020-24140

Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via the pagename parameter to wex/html.php. It can help identify open ports, local network hosts and execute command on local services...

CVE-2020-24136

Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename parameter to wex/html.php...

CVE-2020-24138

Cross Site Scripting XSS vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to wex/html.php...

CVE-2020-24138

CVE-2020-24138 is a Cross Site Scripting (XSS) vulnerability in WCMS 0.3.2. The issue allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to wex/html.php. Connected sources (Red Hat, CNVD, NVD, OSV) all describe the same flaw in WCMS 0.3.2. No concrete explo...

CVE-2020-24138

Cross Site Scripting XSS vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to wex/html.php...

CVE-2020-24140: Server-Side Request Forgery (SSRF)

Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via the pagename parameter to wex/html.php. It can help identify open ports, local network hosts and execute command on local services...

CVE-2020-24138: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to wex/html.php...

CVE-2020-24136: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename parameter to wex/html.php...

PT-2021-11009

Name of the Vulnerable Software and Affected Versions: wcms version 0.3.2 Description: A Cross Site Scripting XSS issue allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to "wex/html.php" API endpoint. Recommendations: For version 0.3.2, avoid using the...

PT-2021-11007

Name of the Vulnerable Software and Affected Versions: Wcms version 0.3.2 Description: The issue allows an attacker to read arbitrary files on the server via the pagename parameter to "wex/html.php" API endpoint. Recommendations: For Wcms version 0.3.2, avoid using the pagename parameter in the...

PT-2021-11011

Name of the Vulnerable Software and Affected Versions: Wcms version 0.3.2 Description: The issue allows an attacker to send crafted requests from the back-end server of a vulnerable web application via the pagename parameter to "wex/html.php". This can be used to identify open ports, local networ...

PT-2019-13555

Name of the Vulnerable Software and Affected Versions WCMS version 0.3.2 Description The issue allows for a CSRF vulnerability, which can lead to directory traversal and modification of the index.html file. This is achieved through the "/wex/html.php?finish=../index.html" API endpoint, where the...