CVE-2023-3445

CVE-2023-3445 affects Spinacms/Spina CMS prior to version 2.15.1. The connected sources confirm a stored XSS vulnerability, located in the Spina admin flow (notably involving the title of pages) that can be triggered by submitting crafted input. If exploited, this could allow arbitrary script exe...

CVE-2015-4619

The CVE-2015-4619 entry concerns a Cross-site request forgery (CSRF) vulnerability in Spina prior to commit bfe44f289e336f80b6593032679300c493735e75. The issue arises because Spina::ApplicationController did not enable CSRF protection, creating a CSRF risk across the engine, including administrat...

CVE-2024-41603

The CVE-2024-41603 entry applies to Spina CMS v2.18.0, where a Cross-Site Request Forgery (CSRF) vulnerability exists through the /admin/layout endpoint. The issue is described as a CSRF in the admin layout API, with CVSS v3.1 metrics: Network attack, low complexity, no privileges, user interacti...

CVE-2024-7106

CVE-2024-7106 affects Spina CMS 2.18.0, in the /admin/media_folders functionality. The issue is a cross-site request forgery (CSRF) in an unknown, user-influenced function that can be triggered remotely. Impact is described as possible manipulation with high severity, though exact exploit details...

CVE-2024-7065

The CVE-2024-7065 entry concerns Spina CMS up to version 2.18.0, where an unknown function in /admin/pages/ is vulnerable to cross-site request forgery. The issue can be triggered remotely, with exploits disclosed publicly. No specific exploit vectors, product versions beyond 2.18.0, or remediati...

CVE-2024-41602

CVE-2024-41602 describes a Cross Site Request Forgery vulnerability in Spina CMS, affecting version 2.18.0 and earlier. The issue allows a remote attacker to escalate privileges via a crafted URL (CSRF). The root cause is a CSRF-based flaw; explicit exploit details are not provided in the availab...