CVE-2018-14029

CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as demonstrated by modifying the account's email field...

Cross site request forgery (csrf)

CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as demonstrated by modifying the account's email field...

CVE-2018-14029

CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as demonstrated by modifying the account's email field...

CVE-2018-14029

CSRF vulnerability in admin/user/edit in Creatiwity wityCMS 0.6.2 allows an attacker to take over a user account, as demonstrated by modifying the account's email field...

CVE-2018-14029

CVE-2018-14029 : CSRF in the WityCMS 0.6.2 admin/user/edit flow allows an attacker to take over a user account by modifying user data (e.g., email, password). The vulnerability stems from cross-site request forgery in the admin interface, with CVSSv3 base score 8.8 (HIGH) and user interaction req...

Creatiwity wityCMS Local File Inclusion Vulnerability

Creatiwity wityCMS is a lightweight PHP-based model-view-controller-oriented content management system CMS. A local file inclusion vulnerability exists in the /system/WCore/WHelper.php file in Creatiwity wityCMS version 0.6.2. A remote attacker can exploit this vulnerability by replacing the...

CVE-2018-12065

A Local File Inclusion vulnerability in /system/WCore/WHelper.php in Creatiwity wityCMS 0.6.2 allows remote attackers to include local PHP files execute PHP code or read non-PHP files by replacing a helper.json file...

Remote file inclusion

A Local File Inclusion vulnerability in /system/WCore/WHelper.php in Creatiwity wityCMS 0.6.2 allows remote attackers to include local PHP files execute PHP code or read non-PHP files by replacing a helper.json file...

CVE-2018-12065

A Local File Inclusion vulnerability in /system/WCore/WHelper.php in Creatiwity wityCMS 0.6.2 allows remote attackers to include local PHP files execute PHP code or read non-PHP files by replacing a helper.json file...

CVE-2018-12065

A Local File Inclusion vulnerability in /system/WCore/WHelper.php in Creatiwity wityCMS 0.6.2 allows remote attackers to include local PHP files execute PHP code or read non-PHP files by replacing a helper.json file...

CVE-2018-12065

CVE-2018-12065 describes a Local File Inclusion in Creatiwity wityCMS 0.6.2. The vuln occurs in /system/WCore/WHelper.php where an attacker can replace helper.json to include local PHP files (potentially executing PHP code) or read non-PHP files. Multiple connected sources corroborate this LFI at...

Creatiwity wityCMS Cross-Site Scripting Vulnerability

Creatiwity wityCMS is a lightweight PHP-based model-view-controller-oriented content management system CMS. A cross-site scripting vulnerability exists in the 'Website's name' field on the 'Settings' page under the 'General' menu in version 0.6.1 of Creatiwity wityCMS. ' field in the 'Settings'...

wityCMS 0.6.1 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: wityCMS 0.6.1 Persistent XSS on "Website's name" field Exploit Author: Nathu Nandwani Website: http://nandtech.co/ Vendor Homepage: https://creatiwity.net/witycms Software Link:...

CVE-2018-11512

Stored cross-site scripting XSS vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to...

Cross site scripting

Stored cross-site scripting XSS vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to...

CVE-2018-11512

Stored cross-site scripting XSS vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to...

CVE-2018-11512

Stored cross-site scripting XSS vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to...

CVE-2018-11512

Creatiwity wityCMS 0.6.1 is affected by a stored XSS in the Settings > General page, in the Website’s name field. The vulnerability occurs via an authenticated POST to admin/settings/general, allowing an attacker to inject arbitrary script/HTML that may be reflected to users. Public references...

wityCMS 0.6.1 - Cross-Site Scripting

wityCMS 0.6.1 - Cross-Site Scripting Exploit Title: wityCMS 0.6.1 Persistent XSS on "Website's name" field Date: 05/28/2018 Exploit Author: Nathu Nandwani Website: http://nandtech.co/ Vendor Homepage: https://creatiwity.net/witycms Software Link:...

wityCMS 0.6.1 - Cross-Site Scripting

Exploit Title: wityCMS 0.6.1 Persistent XSS on "Website's name" field Date: 05/28/2018 Exploit Author: Nathu Nandwani Website: http://nandtech.co/ Vendor Homepage: https://creatiwity.net/witycms Software Link: https://github.com/Creatiwity/wityCMS/releases/tag/0.6.1 Version: 0.6.1 Tested on:...