CVE-2022-30804

The vulnerability CVE-2022-30804 affects elitecms v1.01, with a concrete flaw allowing arbitrary file deletion via the API endpoint /admin/delete_image.php?file= (and variant naming in sources as /admin/delete image.php?file=). This is supported by the PT-2022-20323 advisory, which specifies the ...

CVE-2022-30813

CVE-2022-30813 affects elitecms 1.01 and is caused by a lack of input validation on the /admin/add_post.php page, enabling SQL Injection. Multiple connected sources corroborate the vulnerability and affected product/version. The NVD and other records assign a high/critical impact (CVSS v3.1: 9.8,...

CVE-2022-30814

CVE-2022-30814 affects elitecms v1.01 and is a SQL Injection vulnerability in /admin/add_sidebar.php caused by lack of input validation. Public sources describe attackers possibly stealing sensitive database data by exploiting SQL statements derived from user input. CVSS metrics in the initial en...

CVE-2022-30815

Elitecms 1.01 is vulnerable to SQL injection via admin/edit_sidebar.php?page=2&sidebar due to lack of input validation on the sidebar parameter. This can allow attackers to execute arbitrary SQL and access sensitive data. No published fix is provided in the connected documents; remediation status...

CVE-2022-30808

CVE-2022-30808 affects elitecms 1.0.1. The vulnerability is described as an arbitrary code execution via admin/manage_uploads.php. The NVD entry lists a CVSS v3.1 base score of 9.8 (CRITICAL) with network access, no privileges required, no user interaction, and high impact on confidentiality, int...

CVE-2022-30809

CVE-2022-30809 affects elitecms 1.01, with a SQL injection vulnerability in /admin/edit_page.php?page=. The issue arises from lack of input validation on external input used to construct SQL statements, enabling an attacker to execute arbitrary SQL commands and potentially access or modify the da...

CVE-2022-30810

CVE-2022-30810 affects elitecms v1.01. The vulnerability is an SQL Injection in admin/edit_post.php caused by lack of validation of external input in SQL statements, enabling an attacker to manipulate queries and access or modify database data. Reported CVSS details indicate a high to critical im...

CVE-2022-30816

CVE-2022-30816 affects elitecms 1.01 and is a SQL Injection vulnerability exploitable via the /admin/edit_sidebar.php page. The root cause is lack of validation of the external input SQL statements in the page parameter, enabling an attacker to execute arbitrary SQL commands to steal sensitive da...

CVE-2018-12250

Summary of vulnerability (CVE-2018-12250) : Multiple sources confirm a SQL injection flaw in Elite CMS Pro 2.01, specifically in the /admin/add_sidebar.php file via the vulnerable ?page= parameter. The issue is described as allowing the execution of arbitrary SQL commands, with the potential for ...

CVE-2022-24219

CVE-2022-24219 affects eliteCMS v1.0, with a SQL injection in the /admin/edit_page.php path. The root cause is unsanitized or improperly validated SQL statements in the edit_page.php component, enabling an attacker to manipulate queries and potentially access or modify data. Public documents cons...

CVE-2022-24221

CVE-2022-24221 affects eliteCMS v1.0, with a vulnerability in the file path /admin/functions/functions.php that enables a SQL injection. The connected documents consistently describe remote-exploitation potential through crafted SQL requests to manipulate the database, access sensitive data, or p...

CVE-2021-46093

CVE-2021-46093 details (connected documents): eliteCMS v1.0 is vulnerable to an insecure permissions/file upload issue via manage_uploads.php. Multiple sources describe a web content management platform (Elite Graphix Elite Cms) affected by a file upload vulnerability that, due to lack of proper ...

CVE-2022-24222

The CVE-2022-24222 entry concerns eliteCMS v1.0 with a SQL injection vulnerability in the admin path (/admin/edit_user.php). The issue allows remote attackers to submit a crafted SQL request to manipulate the database, obtain sensitive information, or execute arbitrary code, as described across m...

CVE-2023-42331

CVE-2023-42331 is a file upload vulnerability in EliteCMS v1.01 that allows a remote attacker to execute arbitrary code through the manage_uploads.php component. The core issue is an unrestricted file upload vector within the EliteCMS 1.01 manage_uploads.php path, enabling code execution with the...

CVE-2022-24218

CVE-2022-24218 affects eliteCMS v1.0. The issue resides in /admin/delete_image.php and allows attackers to delete arbitrary files. From the provided metrics, CVSSv2 base score is 6.4 (Network, Low attack complexity, None auth, I/P) with Partial integrity/Partial availability impact, and CVSSv3.1 ...

CVE-2022-24220

EliteCMS v1.0 contains a SQL injection vulnerability in /admin/edit_post.php due to lack of validation of externally entered SQL statements. This affects the web CMS component and can allow an attacker to manipulate queries, potentially impacting data confidentiality, integrity, and availability ...

CVE-2022-40361

Elite CRM v1.2.11 is affected by a Cross-Site Scripting (XSS) vulnerability that allows an attacker to execute arbitrary code via the language parameter to the /ngs/login endpoint. The root cause is insufficient input handling for the language parameter. Impact per sources is limited to confident...