CVE-2024-28417

Webedition CMS 9.2.2.0 has a Stored XSS vulnerability via the /webEdition/we_cmd.php endpoint. The issue affects the webEdition CMS component (we_cmd.php) and requires user interaction; impact is described as low for confidentiality, integrity, and availability (CVSS 3.1 base score 6.3). Some sou...

CVE-2024-28418

CVE-2024-28418 affects Webedition CMS 9.2.2.0 with a file-upload vulnerability exploitable via /webEdition/we_cmd.php. The vulnerability is documented across multiple feeds; the primary technical detail is the file upload path. No explicit fix version is provided in the sources; one advisory note...

CVE-2014-5258

CVE-2014-5258 affects webEdition CMS (pre-6.3.9.0 Beta) where showTempFile.php is vulnerable to directory traversal via the file parameter. The flaw allows remote authenticated users to read arbitrary server files by crafting ../ sequences. Public sources (HTB HTB23227 advisory and CVE entries) c...

CVE-2014-2303

The CVE-2014-2303 issue affects webEdition CMS, specifically the file browser component we_fs.php. It describes SQL injection via the GET parameters table and order that can be exploited to execute arbitrary SQL, with unauthenticated attackers potentially reading the CMS’s database (including pas...

CVE-2014-2302

The CVE-2014-2302 entry is substantiated by multiple connected documents: webEdition CMS installer/online installer vulnerability leading to remote command execution via PHP object injection when the installer communicates with update.webedition.org. Affected versions include webEdition CMS befor...

CVE-2023-53884

Webedition CMS v2.9.8.8 is affected by a stored cross-site scripting vulnerability that allows authenticated users to upload SVG files containing JavaScript via the media upload feature. When these crafted SVGs are viewed by other users, the embedded scripts can be executed, enabling arbitrary sc...

CVE-2023-53883

Webedition CMS v2.9.8.8 is affected by a remote code execution vulnerability via PHP page creation. The issue allows authenticated attackers to inject and execute system commands by placing malicious commands in the description field when creating a PHP page, enabling arbitrary command execution ...