CVE-2020-23962

This CVE-2020-23962 is a documented XSS vulnerability in Catfish CMS 4.9.90. The flaw allows an attacker to inject arbitrary web scripts/HTML via the announcement_gonggao parameter, enabling script execution in the victim’s browser. The affected component is Catfish CMS (version 4.9.90); the root...

CVE-2018-10023

Catfish CMS version 4.7.21 is reported to be vulnerable to a cross-site scripting (XSS) issue in the pinglun parameter of the path cat/index/index/pinglun (an authenticated comment). All connected sources (Red Hat, CNVD, CNVD CNVD-2018-08759, NVD, CVE records) corroborate that this XSS affects Ca...

CVE-2018-18734

CVE-2018-18734 describes a Cross-Site Request Forgery (CSRF) in Catfish CMS 4.8.30, specifically in the admin/Index/addmanageuser.html page. The issue allows unauthorized actions (adding users) via CSRF. Connected sources confirm the vulnerable component and page in Catfish CMS 4.8.30 and indicat...

CVE-2021-45018

Catfish CMS (versions up to 6.3.0) is affected by a Cross-Site Scripting (XSS) vulnerability. The CVE description notes the issue can be triggered via a Google search path involving url:/catfishcms/index.php/admin/Index/addmenu.html and the following .html file, within the affected editor context...

CVE-2018-18733

CVE-2018-18733 concerns an XSS in Catfish CMS 4.8.30 via the admin/Index/write.html flow (related to “write source code”). Connected sources confirm a similar XSS path in Catfish CMS v4.7.9 using the editorValue parameter of admin/Index/write.html, suggesting a common write.html XSS vector across...

CVE-2021-45017

Catfish CMS CSRF in

CVE-2018-13999

Catfish CMS v4.7.9 is vulnerable to cross-site scripting via the admin/Index/write.html editorValue parameter (an administrator-posted article). The CVE-2018-13999 entry documents this XSS flaw; related entries note a similar issue in Catfish CMS 4.8.30. The provided documents do not specify a pa...