CVE-2018-1999021

CVE-2018-1999021 affects GleezCMS Gleez Cms 1.3.0. The vulnerability is a Cross-Site Scripting (XSS) flaw in the Profile page editor that can allow injecting arbitrary web script or HTML. Exploitation requires the victim to visit the attacker’s profile page, with the attacker exercising control o...

CVE-2018-16704

CVE-2018-16704 affects Gleez CMS v1.2.0. The issue is an Insecure Direct Object Reference that allows authenticated users to view the profile page of other users, demonstrated by accessing /user/3 on demo.gleezcms.org. This is a user-authorization bypass that could expose profile details to other...