CVE-2024-44871

CVE-2024-44871 affects moziloCMS v3.0. An arbitrary file upload vulnerability exists in the /admin/index.php component that enables an authenticated attacker to achieve arbitrary code execution by uploading a crafted file (e.g., a JPG) and renaming it to PHP via the admin interface. Multiple sour...

CVE-2024-44872

CVE-2024-44872 describes a reflected XSS vulnerability in moziloCMS v3.0 that could let an attacker execute arbitrary code in a user’s browser by injecting a crafted payload. The NVD entry cites a CVSSv3.1 base score of 6.1 (Medium) with network access, low attack complexity, no privileges requir...

CVE-2020-25394

The connected records confirm CVE-2020-25394 affects moziloCMS 2.0 with a stored XSS via the Content parameter. Authenticated users can inject web scripts/HTML, enabling arbitrary script execution in the context of the affected web app. The vulnerability is described consistently across CVE/NVD a...

CVE-2024-29368

CVE-2024-29368 affects moziloCMS v2.0, targeting the file handling module. The vulnerability enables an attacker to bypass extension restrictions by renaming uploaded files, potentially allowing arbitrary code execution or storage of malicious content. Public documentation from multiple sources c...

CVE-2024-2245

moziloCMS 2.0 is affected by CVE-2024-2245: a Cross-Site Scripting flaw allows a JavaScript payload to be executed by sending a POST to /install.php, targeting the username parameter. This is supported by multiple connected sources describing the same vulnerability; exploitation status and fixes ...

CVE-2022-23357

The CVE-2022-23357 issue affects moziloCMS (Mozilo 2.0). A directory traversal vulnerability exists in the curent_dir parameter, enabling an attacker to access sensitive information outside the intended directory. Root cause: improper validation of the curent_dir input allows traversal sequences....

CVE-2008-6128

CVE-2008-6128 is a session-fixation vulnerability in moziloCMS 1.10.2 and earlier that allows an attacker to hijack user sessions by supplying a PHPSESSID value. The connected documents corroborate the same description across NVD and CVE listings, confirming the affected product and the root caus...

CVE-2009-4209

moziloCMS 1.11.1 is affected by multiple XSS vulnerabilities in admin/index.php (editsite action) via the cat and file parameters. The issue is confirmed by NVD/OpenVAS data referencing moziloCMS

CVE-2009-1367

MoziloCMS vulnerability CVE-2009-1367 affects moziloCMS 1.11 (index.php) with XSS via the search action parameter. The OpenVAS entry also notes a local file-include (LFI) and XSS issue in moziloCMS, indicating input sanitization failures. Affected component: moziloCMS web application; issue type:...

CVE-2009-1369

MoziloCMS 1.11 is affected by CVE-2009-1369. The vulnerability allows remote attackers to obtain sensitive information by triggering error messages through specific parameters: gal[] in gallery.php, page[] and cat[] in index.php, and file[] in download.php, which reveal the installation path. The...

CVE-2008-6127

CVE-2008-6127 affects moziloCMS

CVE-2009-1368

CVE-2009-1368 describes a directory traversal vulnerability in moziloCMS 1.11 where an attacker can read arbitrary files by injecting a deroute “..” into the page parameter of index.php. Related entries indicate a similar issue in moziloCMS 1.10.2 and earlier (CVE-2008-6126) with the same dot-dot...

CVE-2008-6126

CVE-2008-6126 affects moziloCMS 1.10.2 and earlier. The vulnerability is a directory traversal in moziloCMS via a .. in the file parameter to download.php and the page parameter to index.php, enabling remote reading of arbitrary files. Affected components: download.php and index.php within mozilo...

CVE-2008-3589

The CVE-2008-3589 entry refers to a directory traversal in moziloCMS 1.10.1’s download.php, exploitable when magic_quotes_gpc is disabled. An attacker can read arbitrary files by injecting ".." into the cat parameter, enabling unintended file access. The vulnerability impacts moziloCMS version 1....