CVE-2024-44724

The AutoCMS v5.4 Content Management System contains a PHP code injection vulnerability. The root cause is the improper handling of the txtsite_url parameter at the /admin/site_add.php API endpoint, which allows an attacker to execute arbitrary PHP code by injecting a crafted value. This could lea...

CVE-2024-44725

AutoCMS version 5.4 is vulnerable to a SQL injection vulnerability. The root cause is the lack of validation for externally entered SQL statements within the sidebar parameter at the /admin/robot.php endpoint. An attacker can exploit this to execute illegal SQL commands, potentially leading to th...

CVE-2024-8866

Summary: CVE-2024-8866 affects AutoCMS 5.4. The vulnerability exists in an unknown part of the file /admin/robot.php where manipulation of the parameter sidebar leads to cross-site scripting (XSS) . It can be exploited remotely, and the exploit has been disclosed publicly. Impact (as documented):...