CVE-2018-7172

In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal...

CVE-2018-7172

Affected software: WonderCMS (index.php) prior to version 2.4.1. Vulnerability: directory traversal can be exploited by remote attackers to delete arbitrary files on the server (CWE-22). Root cause: improper handling of directory paths in index.php allows traversal sequences. Impact: arbitrary fi...

CVE-2018-7172

In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal...

WonderCMS File Upload Cross-Site Scripting Vulnerability

WonderCMS is a PHP-based content management system CMS.File Upload is one of the file upload function modules. A cross-site scripting vulnerability exists in File Upload in WonderCMS version 2.4.0. An attacker can exploit this vulnerability to execute arbitrary scripts on a user's browser...

CVE-2018-1000062

WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAction, 'svg' = 'image/svg+xml' that can result in An attacker can execute arbitrary script on an unsuspecting user's browser. This attack appear to be exploitable via Crafted SVG...

CVE-2018-1000062

WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAction, 'svg' = 'image/svg+xml' that can result in An attacker can execute arbitrary script on an unsuspecting user's browser. This attack appear to be exploitable via Crafted SVG...

Cross site scripting

WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAction, 'svg' = 'image/svg+xml' that can result in An attacker can execute arbitrary script on an unsuspecting user's browser. This attack appear to be exploitable via Crafted SVG...

CVE-2018-1000062

CVE-2018-1000062 affects WonderCMS version 2.4.0. The vulnerability is a stored XSS in file uploads via SVG in uploadFileAction(), where a crafted SVG file with content-type image/svg+xml can cause script execution in an unsuspecting user’s browser. The CVSS data indicates a network-exposed issue...

CVE-2018-1000062

WonderCMS version 2.4.0 contains a Stored Cross-Site Scripting on File Upload through SVG vulnerability in uploadFileAction, 'svg' = 'image/svg+xml' that can result in An attacker can execute arbitrary script on an unsuspecting user's browser. This attack appear to be exploitable via Crafted SVG...

WonderCMS Stored Cross-Site Scripting Vulnerability

WonderCMS is an open source, fast, small and simple flat file cms. A stored cross-site scripting vulnerability exists in WonderCMS 2.3.1. The vulnerability arises because the input fields of the application accept arbitrary user input. An attacker can exploit this vulnerability to execute malicio...

WonderCMS HTTP Host Header Injection Vulnerability

WonderCMS is an open source, fast, small and simple flat file cms. WonderCMS 2.3.1 suffers from an HTTP host header injection vulnerability. An attacker can exploit the vulnerability to redirect pages...

WonderCMS Malicious File Upload Vulnerability

WonderCMS is an open source, fast, small and simple flat file cms. A malicious file upload vulnerability exists in WonderCMS 2.3.1. The vulnerability arises because the upload function accepts random application extensions. An attacker can exploit this vulnerability to upload malicious files...

Design/Logic Flaw

In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload...

Design/Logic Flaw

DISPUTED WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local machine or from the administrator as a self attack...

Input validation

DISPUTED In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this issue stating that this is a feature that enables only a logged in administrator to write execute JavaScript anywhere on their...

CVE-2017-14521

In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload...

CVE-2017-14522

In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this issue stating that this is a feature that enables only a logged in administrator to write execute JavaScript anywhere on their website...

CVE-2017-14523

WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local machine or from the administrator as a self attack...

CVE-2017-14522

In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this issue stating that this is a feature that enables only a logged in administrator to write execute JavaScript anywhere on their website...

CVE-2017-14523

WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local machine or from the administrator as a self attack...