CVE-2024-28417

The Webedition CMS version 9.2.2.0 is affected by a Stored Cross-Site Scripting (XSS) vulnerability located in the /webEdition/we_cmd.php API endpoint. This flaw allows for the persistent execution of malicious scripts in the context of the user's session. As of the current documentation, no patc...

CVE-2024-28418

The Webedition CMS version 9.2.2.0 is susceptible to a File upload vulnerability via the /webEdition/we_cmd.php API endpoint. This flaw allows for the unrestricted upload of files with dangerous types (CWE-434). An attacker could potentially leverage this to upload and execute malicious files on ...

CVE-2014-5258

CVE-2014-5258 affects webEdition CMS (pre-6.3.9.0 Beta) where showTempFile.php is vulnerable to directory traversal via the file parameter. The flaw allows remote authenticated users to read arbitrary server files by crafting ../ sequences. Public sources (HTB HTB23227 advisory and CVE entries) c...

CVE-2014-2302

The CVE-2014-2302 entry is substantiated by multiple connected documents: webEdition CMS installer/online installer vulnerability leading to remote command execution via PHP object injection when the installer communicates with update.webedition.org. Affected versions include webEdition CMS befor...

CVE-2014-2303

The CVE-2014-2303 issue affects webEdition CMS, specifically the file browser component we_fs.php. It describes SQL injection via the GET parameters table and order that can be exploited to execute arbitrary SQL, with unauthenticated attackers potentially reading the CMS’s database (including pas...

CVE-2023-53884

Webedition CMS v2.9.8.8 is affected by a stored cross-site scripting vulnerability that allows authenticated users to upload SVG files containing JavaScript via the media upload feature. When these crafted SVGs are viewed by other users, the embedded scripts can be executed, enabling arbitrary sc...

CVE-2023-53883

Webedition CMS v2.9.8.8 is affected by a remote code execution vulnerability via PHP page creation. The issue allows authenticated attackers to inject and execute system commands by placing malicious commands in the description field when creating a PHP page, enabling arbitrary command execution ...