CVE-2015-1373

The CVE-2015-1373 entry concerns ferretCMS 1.0.4-alpha, where multiple XSS vulnerabilities exist in admin.php. The attacker can inject arbitrary script/HTML through: (1) the action parameter in a search request, (2) the username in a login request that is not properly handled when logging the eve...

CVE-2015-1372

CVE-2015-1372 affects ferretCMS 1.0.4-alpha. The vulnerability is a SQL injection in the update action of admin.php via the p parameter, allowing remote attackers to execute arbitrary SQL commands. Impact is described as enabling data access/ modification with partial confidentiality, integrity, ...

CVE-2015-1374

CVE-2015-1374 relates to multiple CSRF vulnerabilities in ferretCMS 1.0.4-alpha, specifically in admin.php, enabling remote attackers to hijack administrator authentication for requests that perform (1) XSS, (2) SQL injection, and (3) unrestricted file upload. The connected sources confirm the af...

CVE-2015-1371

FerretCMS 1.0.4-alpha contains an Unrestricted file upload vulnerability that allows remote administrators to execute arbitrary code by uploading a file with an executable extension and then accessing it via a direct request to the file under custom/uploads/. The reports indicate the vulnerabilit...