CVE-2017-20063

Elefant CMS 1.3.12-RC contains a vulnerability in the filemanager/upload/drop component of the File Upload function that leads to improper privilege management. The issue is exploitable remotely because it affects an unknown function in that file path. Upgrading to version 1.3.13 is cited as the ...

CVE-2017-20059

Summary: CVE-2017-20059 affects Elefant CMS 1.3.12-RC, where the Title Handler component accepts input that can be manipulated to trigger persistent cross-site scripting (XSS). The issue is exploitable remotely and is linked to how the input is processed in the Title Handler. Root cause: insuffic...

CVE-2017-20060

CVE-2017-20060 affects Elefant CMS 1.3.12-RC, specifically the Blog Post Handler. The issue enables a persistent cross-site scripting (XSS) vulnerability that can be triggered remotely. Upgrading to version 1.3.13 is identified as the fix. The available connected sources confirm the vulnerability...

CVE-2017-20064

Elefant CMS 1.3.12-RC contains a remote code-injection vulnerability in an unknown function of /designer/add/layout. The issue allows manipulation leading to code execution and is addressed by upgrading to version 1.3.13. Multiple connected sources corroborate the existence of the code-injection ...

CVE-2017-20061

Elefant CMS 1.3.12-RC is affected by a reflected cross-site scripting (XSS) in the /admin/extended handling. The vulnerability arises from manipulating the argument name with the payload %3Cimg%20src=no%20onerror=alert(1)%3E, enabling remote exploitation. The issue is specified as part of CVE-201...

CVE-2017-20062

CVE-2017-20062 affects Elefant CMS 1.3.12-RC. The issue is a cross-site request forgery (CSRF) vulnerability that can be manipulated remotely; exploit has been disclosed publicly. Upgrading to version 1.3.13 mitigates the issue. Multiple connected sources (RH, NVD, OSV, CNVD, CNVD/Vuln enrichment...

CVE-2017-20057

Elefant CMS 1.3.12-RC contains a cross-site scripting (Persistent) vulnerability via an unknown function that manipulates the username argument. Exploitation can be performed remotely. The issue is mitigated by upgrading to version 1.3.13, per the CVE description and corroborating vendor entries ...