CVE-2018-10321

Summary: Frog CMS 0.9.5 has a stored Cross-Site Scripting vulnerability via the Settings page’s Admin Site title. An admin can inject payloads that are stored and later executed in other contexts, per multiple sources. Public exploits exist (e.g., Exploit-DB and PacketStorm entries) describing th...

CVE-2018-10320

CVE-2018-10320 affects Frog CMS 0.9.5 with a stored/reflected XSS via the admin/?/layout/edit layout[name] parameter (Edit Layout). The CNVD entry and NVD description confirm a cross-site scripting vulnerability in Frog CMS 0.9.5, exploitable remotely by crafting the name input to inject script. ...

CVE-2018-10806

CVE-2018-10806 (Frog CMS 0.9.5) : A reflected Cross-Site Scripting vulnerability exists in Frog CMS via the file[current_name] parameter to the admin/?/plugin/file_manager/rename URI. The issue can be exploited in conjunction with CSRF. Affected product: Frog CMS 0.9.5. Vulnerable component: the ...

CVE-2018-10319

Frog CMS 0.9.5 is affected by a Cross‑Site Scripting (XSS) vulnerability in the admin/?/snippet/edit (snippet[name]) parameter, i.e., the Edit Snippet action. The issue enables injection via the snippet name during edit, as documented under CVE-2018-10319. Connected records also reference the rel...

CVE-2018-10570

CVE-2018-10570 affects Frog CMS 0.9.5. The vulnerability is a Cross-Site Scripting (XSS) flaw in /install/index.php via the ['config']['admin_username'] field. CNVD notes that an attacker could inject arbitrary web script or HTML, implying a client-side impact on affected sessions/pages. The Red ...

CVE-2018-19844

Affected software: Frog CMS 0.9.5. Vulnerability: Cross-Site Scripting (XSS) via the admin/?/snippet/edit or admin/?/snippet/add name parameter, due to mishandling during snippet edit/add actions. Impact: XSS could allow arbitrary script injection. Root cause / details: The XSS is described acros...

CVE-2018-10318

Frog CMS 0.9.5 contains a cross-site scripting (XSS) vulnerability in the admin/?/page/edit page[keywords] parameter (Edit Page Metadata). The issue arises from user-supplied content in the keywords field that is reflected in the page. Exploitation specifics beyond this description are not provid...

CVE-2018-16447

CVE-2018-16447 affects Frog CMS 0.9.5, where the admin/?/user/edit/1 endpoint is vulnerable to Cross-Site Request Forgery (CSRF). The vulnerability arises in the admin interface and could enable remote attackers to perform unauthorized operations on behalf of an authenticated user. The provided d...