PT-2018-5677

Name of the Vulnerable Software and Affected Versions: WonderCMS version 2.3.1 Description: The issue concerns the upload functionality, which accepts random application extensions, leading to malicious file upload. Recommendations: For WonderCMS version 2.3.1, consider disabling the upload...

CVE-2017-14522: Improper Neutralization of Input During Web Page Generation

In WonderCMS 2.3.1, the application's input fields accept arbitrary user input resulting in execution of malicious JavaScript. NOTE: the vendor disputes this issue stating that this is a feature that enables only a logged in administrator to write execute JavaScript anywhere on their website...

PT-2018-5679 · Wondercms · Wondercms

Name of the Vulnerable Software and Affected Versions: WonderCMS version 2.3.1 Description: The issue allows for an HTTP Host header injection attack. It utilizes user-entered values to redirect pages. The vendor notes that exploitation is unlikely since the attack can only originate from a local...

CVE-2017-14521: Unrestricted Upload of File with Dangerous Type

In WonderCMS 2.3.1, the upload functionality accepts random application extensions and leads to malicious File Upload...

CVE-2017-14523: Improper Neutralization of Special Elements in Output Used by a Downstream Component

WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection attack. It uses user-entered values to redirect pages. NOTE: the vendor reports that exploitation is unlikely because the attack can only come from a local machine or from the administrator as a self attack...

PT-2018-5678 · Wondercms · Wondercms

Name of the Vulnerable Software and Affected Versions: WonderCMS version 2.3.1 Description: The application's input fields accept arbitrary user input, resulting in the execution of malicious JavaScript. It is noted that the vendor disputes this issue, stating it is a feature that enables only a...

WonderCMS Cross-Site Request Forgery Vulnerability

WonderCMS is a PHP-based content management system. A cross-site request forgery vulnerability exists in WonderCMS. A remote attacker can exploit this vulnerability to perform unauthorized operations with null values or malformed command identifiers...

WonderCMS 2.1.0 Cross Site Request Forgery

document.forms0.submit; !-- Disclosure Timeline: --------------------- 2017-06-16: Vulnerability found. 2017-06-17: Reported to vendor. 2017-06-17: Vendor responded and send a new version for test in it. 2017-06-17: Test new version and vulernability patched successfully. 2017-06-18: Vendor...

WonderCMS 2.1.0 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications document.forms0.submit; !-- Disclosure Timeline: --------------------- 2017-06-16: Vulnerability found. 2017-06-17: Reported to vendor. 2017-06-17: Vendor responded and send a new version for test in it. 2017-06-17: Test new version and...

WonderCMS 2.1.0 - Cross-Site Request Forgery

WonderCMS 2.1.0 - Cross-Site Request Forgery document.forms0.submit; !-- Disclosure Timeline: --------------------- 2017-06-16: Vulnerability found. 2017-06-17: Reported to vendor. 2017-06-17: Vendor responded and send a new version for test in it. 2017-06-17: Test new version and vulernability...

WonderCMS 2.1.0 - Cross-Site Request Forgery

document.forms0.submit; !-- Disclosure Timeline: --------------------- 2017-06-16: Vulnerability found. 2017-06-17: Reported to vendor. 2017-06-17: Vendor responded and send a new version for test in it. 2017-06-17: Test new version and vulernability patched successfully. 2017-06-18: Vendor...

Cross site request forgery (csrf)

WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context...

CVE-2017-7951

WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context...

CVE-2017-7951

WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context...

CVE-2017-7951

CVE-2017-7951 affects WonderCMS prior to version 2.0.3. The vulnerability is a CSRF due to lack of a token in an unspecified context, as described in NVD and corroborated by multiple sources. The primary affected component is WonderCMS’s request handling where a missing anti-CSRF token enables CS...

CVE-2017-7951

WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context...

CVE-2017-7951

WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context...

CVE-2017-7951: Cross-Site Request Forgery (CSRF)

WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context...

PT-2017-18023

Name of the Vulnerable Software and Affected Versions WonderCMS versions prior to 2.0.3 Description The issue is related to a lack of a token in an unspecified context, leading to CSRF. Recommendations For versions prior to 2.0.3, update to version 2.0.3 or later to resolve the issue...

WonderCMS 0.9.8 Cross Site Scripting

============================================= MGC ALERT 2016-006 - Original release date: Nov 16, 2016 - Last revised: Nov 21, 2016 - Discovered by: Manuel Garcia Cardenas - Severity: 4,8/10 CVSS Base Score ============================================= I. VULNERABILITY -------------------------...