36 matches found
CVE-2023-41425
CVE-2023-41425 (WonderCMS) affects WonderCMS versions 3.2.0–3.4.2. The vulnerability is an XSS/authenticated file upload flaw in the installModule pathway that enables an attacker to upload a crafted script, which can subsequently execute arbitrary code on the server (RCE). Connected exploits des...
CVE-2022-43332
CVE-2022-43332 affects WonderCMS v3.3.4. The vulnerability is a cross-site scripting (XSS) flaw exploitable via the Craft payload injected into the Site title field in the Configuration Panel, allowing execution of arbitrary web scripts/HTML. Notable impact details are that the issue concerns the...
CVE-2020-35314
WonderCMS 3.1.3 is affected by a remote code execution via installUpdateThemePluginAction in index.php, enabling an attacker to upload a crafted plugin through the theme/plugin installer and execute arbitrary code. Some sources indicate this requires an authenticated session (authenticated RCE) a...
CVE-2020-35313
WonderCMS 3.1.3 is affected by a server-side request forgery (SSRF) in the addCustomThemePluginRepository function of index.php, enabling remote code execution via a crafted URL to the theme/plugin installer. Exploitation requires an authenticated session; a confirmed path in the public docs show...
CVE-2024-32341
CVE-2024-32341 affects WonderCMS v3.4.3, specifically the Home page. The vulnerability is described as multiple XSS flaws that allow an attacker to inject arbitrary web scripts or HTML via crafted payloads into parameters, as noted across multiple sources. Some connected documents describe the im...
CVE-2024-32743
CVE-2024-32743 affects WonderCMS v3.4.3. A cross-site scripting (XSS) vulnerability exists in the Settings section via the SITE LANGUAGE CONFIG parameter under the Security module, allowing an attacker to execute arbitrary web scripts or HTML. Root cause is improper handling of input in the Setti...
CVE-2024-32337
WonderCMS v3.4.3 is affected by a cross-site scripting (XSS) vulnerability in the Settings section, allowing an attacker to inject arbitrary script or HTML via a crafted payload in the ADMIN LOGIN URL parameter under the Security module. The CVE is CVE-2024-32337. Affected component: Settings → S...
CVE-2020-29233
WonderCMS 3.1.3 is affected by a cross-site scripting (XSS) vulnerability in the Page Description component. The CVE-2020-29233 entries describe a stored/XSS condition that allows an attacker to inject payloads via the Page Description, which can trigger for every user visiting the site and may e...
CVE-2017-14523
WonderCMS 2.3.1 is vulnerable to an HTTP Host header injection that allows host header manipulation to redirect pages. The CVE entry notes exploitation is unlikely because the attack would originate from a local machine or an administrator (self-attack). Public exploit references (Exploit-DB/Pack...
CVE-2020-29247
WonderCMS 3.1.3 is affected by a cross-site scripting (XSS) vulnerability in the Admin Panel. The issue allows an attacker to inject an XSS payload via Page keywords, which triggers for each user visit and can enable cookie theft. The vulnerability is documented across multiple sources (NVD, Red ...
CVE-2024-32340
CVE-2024-32340 affects WonderCMS v3.4.3 with an XSS in the Settings/Menu module via the WEBSITE TITLE parameter. The vulnerability allows execution of arbitrary scripts/HTML when a crafted payload is supplied. CVSS v3.1 base score 9.6 (Critical): Network attack vector, low complexity, required us...
CVE-2024-41305
WonderCMS v3.4.3 contains a Server-Side Request Forgery (SSRF) in the Plugins Page disclosed across multiple sources. The vulnerability arises from unvalidated input in the pluginThemeUrl parameter, enabling an attacker to coerce the application into making arbitrary outgoing requests. Impact det...
CVE-2024-32338
WonderCMS v3.4.3 is affected by a cross-site scripting (XSS) vulnerability in the Settings section, exploitable via a crafted payload in the PAGE TITLE parameter under the Current Page module. Impact: can disclose/modify data (low confidentiality and integrity impact) with no availability impact ...
CVE-2018-1000062
CVE-2018-1000062 affects WonderCMS version 2.4.0. The vulnerability is a stored XSS in file uploads via SVG in uploadFileAction(), where a crafted SVG file with content-type image/svg+xml can cause script execution in an unsuspecting user’s browser. The CVSS data indicates a network-exposed issue...
CVE-2024-27561
WonderCMS (version 3.1.3) is affected by a Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function. The vulnerability allows an attacker to coerce the application into making arbitrary outbound requests by injecting crafted URLs into the installThemePlugin parameter. Pub...
CVE-2024-32744
WonderCMS v3.4.3 contains a cross-site scripting (XSS) vulnerability in the Settings section. The flaw allows arbitrary script/HTML execution via a payload in the PAGE KEYWORDS parameter under the CURRENT PAGE module. Public sources confirm the affected component and trigger, but none provide a p...
CVE-2024-32746
CVE-2024-32746 describes an XSS vulnerability in WonderCMS v3.4.3 within the Settings section, exploitable via a crafted payload injected into the MENU parameter under the Menu module. Affected software is WonderCMS 3.4.3; impact is arbitrary script/HTML execution in the user’s browser. Core deta...
CVE-2014-8702
Wonder CMS 2014 has an information disclosure vulnerability where logging in with an array as the password triggers an error message that reveals the installation path. Affected software: Wonder CMS 2014. Root cause: error handling leaks the installation path in the login error message. Impact: p...
CVE-2017-14521
WonderCMS 2.3.1 is affected by CVE-2017-14521 due to an upload function that accepts arbitrary file extensions, allowing malicious files to be uploaded. Proof-of-concept materials show a PHP shell upload and access to executed commands via a crafted file, indicating a vulnerability in the file-up...
CVE-2025-3123
WonderCMS 3.5.0 is affected by CVE-2025-3123 due to an issue in installUpdateModuleAction within Theme Installation/Plugin Installation that allows unrestricted upload. The attack can be remotely triggered; the exploit has been publicly disclosed, though the vulnerability’s existence is disputed....
CVE-2017-14522
Summary: CVE-2017-14522 affects WonderCMS 2.3.1, where input fields can accept arbitrary data and lead to execution of malicious JavaScript. Multiple sources corroborate a stored XSS risk in WonderCMS 2.3.1, with vendor dispute that this is a feature allowing only a logged-in administrator to wri...
CVE-2020-29469
CVE-2020-29469 affects WonderCMS 3.1.3 with a cross-site scripting (XSS) flaw in the Menu component. The vulnerability lets an attacker inject arbitrary scripts via the Menu settings, which are then executed when users visit the site directory, enabling cookie theft per the documented payload exa...
CVE-2024-32339
WonderCMS v3.4.3 has multiple XSS vulnerabilities on the HOW TO page. The flaws arise from insufficient input filtering/escaping on the HOW TO page, allowing an attacker to inject arbitrary web scripts/HTML via crafted payloads into parameters. Per sources, this can lead to theft of cookie-based ...
CVE-2024-41304
The CVE-2024-41304 entry refers to WonderCMS v3.4.3 and reports an arbitrary file upload vulnerability in the uploadFileAction() function. A crafted SVG file can lead to arbitrary code execution on affected installations. Connected sources consistently describe the same issue without detailing ex...
CVE-2024-27563
CVE-2024-27563 is an SSRF in WonderCMS v3.1.3, traced to the getFileFromRepo function. The flaw lets an attacker coerce the application to make arbitrary outbound requests by injecting crafted URLs into the pluginThemeUrl parameter. Affected software: WonderCMS 3.1.3 (PHP-based CMS). Root cause: ...
CVE-2024-32745
CVE-2024-32745 is an XSS vulnerability in WonderCMS v3.4.3. The issue stems from lack of proper filtering/escaping in the PAGE DESCRIPTION parameter of the CURRENT PAGE module under Settings, allowing an attacker to inject arbitrary web scripts or HTML. Public references consistently describe the...
CVE-2014-8705
The CVE-2014-8705 issue concerns Wonder CMS 2014, where editInplace.php is vulnerable to a PHP Remote File Inclusion. An attacker can trigger arbitrary PHP code execution by supplying a crafted URL in the hook parameter. Connected sources (CNVD-2017-03526) confirm the vulnerability exists in Wond...
CVE-2017-7951
CVE-2017-7951 affects WonderCMS prior to version 2.0.3. The vulnerability is a CSRF due to lack of a token in an unspecified context, as described in NVD and corroborated by multiple sources. The primary affected component is WonderCMS’s request handling where a missing anti-CSRF token enables CS...
CVE-2014-8701
CVE-2014-8701 affects Wonder CMS 2014. A remote attacker can view /files/password to obtain sensitive information, exposing unsalted MD5 hashes. Connected records corroborate information disclosure in Wonder CMS 2014, with impact described as partial confidentiality (CVSS2/3 data: base scores 5.0...
CVE-2014-8703
Wonder CMS 2014 is affected by a Cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML. The provided documents consistently reference Wonder CMS 2014 in relation to CVE-2014-8703, but do not supply concrete details on vulnerable versions, the...
CVE-2011-5317
The CVE-2011-5317 entry describes an XSS vulnerability in WonderCMS prior to version 0.4, exploitable through the content parameter in editText.php. Affected software: WonderCMS (pre-0.4); vulnerable component: editText.php. Root cause: cross-site scripting via unescaped content input. Impact: al...
CVE-2014-8704
CVE-2014-8704 refers to a directory traversal vulnerability in the Wonder CMS 2014 series, specifically in the index.php file. A remote attacker can exploit a specially crafted theme to cause local file inclusion and arbitrary code execution, enabling reading or executing arbitrary local files. T...
CVE-2018-7172
Affected software: WonderCMS (index.php) prior to version 2.4.1. Vulnerability: directory traversal can be exploited by remote attackers to delete arbitrary files on the server (CWE-22). Root cause: improper handling of directory paths in index.php allows traversal sequences. Impact: arbitrary fi...
CVE-2018-14387
Vulnerability : CVE-2018-14387 affects WonderCMS prior to 2.5.2. Root cause : session fixation allowing an attacker to create a session, obtain its identifier, and cause the victim to authenticate using the same session. Impact : attacker can access the user’s account through the active session o...
CVE-2025-57055
WonderCMS 3.5.0 is affected by a Server-Side Request Forgery (SSRF) in the custom module installation feature. An authenticated administrator can supply a malicious URL via the pluginThemeUrl POST parameter, and the server fetches it with curl_exec() without sufficient validation, enabling potent...