CVE-2017-8302

CVE-2017-8302 affects Mura CMS 7.0.6967 and enables Cross‑Site Scripting via the admin/?muraAction= parameter, impacting multiple admin views (list.cfm, dsp_*.cfm, loadsiteflat.cfm, etc.). The root cause is reflected/stored XSS in the muraAction handling within the admin CFML components. Public r...

CVE-2018-7486

Blue River Mura CMS before v7.0.7029 is affected by an arbitrary code execution vulnerability. The issue arises from supporting inline function calls using [m]...[/m] tags without proper restrictions on file types or pathnames, enabling a remote attacker to trigger code execution via an [m]$.dspi...