CVE-2018-18257

CVE-2018-18257 affects BageCMS 3.1.3. The issue is a directory-traversal in the admin template batch deleteFile/deleteFolder endpoints (index.php?r=admini/template/batch&command=deleteFile&fileName=… or &command=deleteFolder&folderName=..…), allowing an attacker to delete arbitrary files and fold...

CVE-2019-8421

CVE-2019-8421 affects BageCMS up to version 3.1.4. The vulnerability is an SQL Injection in the file upload/protected/modules/admini/views/post/index.php triggered via the title or titleAlias parameters. Public references in NVD and CVE records confirm the path and parameter-based injection vecto...