315 matches found
CVE-2017-14521
In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload...
CVE-2017-14522
In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this issue stating that this is a feature that enables only a logged in administrator to write execute JavaScript anywhere on their website...
CVE-2017-14523
WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local machine or from the administrator as a self attack...
CVE-2017-14521
In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload...
CVE-2017-14522
Summary: CVE-2017-14522 affects WonderCMS 2.3.1, where input fields can accept arbitrary data and lead to execution of malicious JavaScript. Multiple sources corroborate a stored XSS risk in WonderCMS 2.3.1, with vendor dispute that this is a feature allowing only a logged-in administrator to wri...
CVE-2017-14522
In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this issue stating that this is a feature that enables only a logged in administrator to write execute JavaScript anywhere on their website...
CVE-2017-14523
WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection that allows host header manipulation to redirect pages. The CVE entry notes exploitation is unlikely because the attack would originate from a local machine or an administrator (self-attack). Public exploit references (Exploit-DB/Pack...
CVE-2017-14521
WonderCMS 2.3.1 is affected by CVE-2017-14521 due to an upload function that accepts arbitrary file extensions, allowing malicious files to be uploaded. Proof-of-concept materials show a PHP shell upload and access to executed commands via a crafted file, indicating a vulnerability in the file-up...
PT-2018-5679 · Wondercms · Wondercms
Name of the Vulnerable Software and Affected Versions: WonderCMS version 2.3.1 Description: The issue allows for an HTTP Host header injection attack. It utilizes user-entered values to redirect pages. The vendor notes that exploitation is unlikely since the attack can only originate from a local...
PT-2018-5678 · Wondercms · Wondercms
Name of the Vulnerable Software and Affected Versions: WonderCMS version 2.3.1 Description: The application's input fields accept arbitrary user input, resulting in the execution of malicious JavaScript. It is noted that the vendor disputes this issue, stating it is a feature that enables only a...
WonderCMS Cross-Site Request Forgery Vulnerability
WonderCMS is a PHP-based content management system. A cross-site request forgery vulnerability exists in WonderCMS. A remote attacker can exploit this vulnerability to perform unauthorized operations with null values or malformed command identifiers...
WonderCMS 2.1.0 - Cross-Site Request Forgery Vulnerability
Exploit for php platform in category web applications document.forms0.submit; !-- Disclosure Timeline: --------------------- 2017-06-16: Vulnerability found. 2017-06-17: Reported to vendor. 2017-06-17: Vendor responded and send a new version for test in it. 2017-06-17: Test new version and...
WonderCMS 2.1.0 Cross Site Request Forgery
document.forms0.submit; !-- Disclosure Timeline: --------------------- 2017-06-16: Vulnerability found. 2017-06-17: Reported to vendor. 2017-06-17: Vendor responded and send a new version for test in it. 2017-06-17: Test new version and vulernability patched successfully. 2017-06-18: Vendor...
WonderCMS 2.1.0 - Cross-Site Request Forgery
WonderCMS 2.1.0 - Cross-Site Request Forgery document.forms0.submit; !-- Disclosure Timeline: --------------------- 2017-06-16: Vulnerability found. 2017-06-17: Reported to vendor. 2017-06-17: Vendor responded and send a new version for test in it. 2017-06-17: Test new version and vulernability...
WonderCMS 2.1.0 - Cross-Site Request Forgery
document.forms0.submit; !-- Disclosure Timeline: --------------------- 2017-06-16: Vulnerability found. 2017-06-17: Reported to vendor. 2017-06-17: Vendor responded and send a new version for test in it. 2017-06-17: Test new version and vulernability patched successfully. 2017-06-18: Vendor...
CVE-2017-7951
WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context...
CVE-2017-7951
WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context...
Cross site request forgery (csrf)
WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context...
CVE-2017-7951
CVE-2017-7951 affects WonderCMS prior to version 2.0.3. The vulnerability is a CSRF due to lack of a token in an unspecified context, as described in NVD and corroborated by multiple sources. The primary affected component is WonderCMS’s request handling where a missing anti-CSRF token enables CS...