CVE-2023-36217

Xoops CMS v2.5.10 contains a Cross Site Scripting vulnerability in the category name field of the image manager function, enabling a remote attacker to execute arbitrary code. The issue is described as high-severity (CRITICAL) with CVSSv3.1 metrics; exploitation is demonstrated in public referenc...

CVE-2017-11174

CVE-2017-11174 is a SQL injection vulnerability affecting XOOPS Core 2.5.8.1, in the file install/page_dbsettings.php. The issue arises from unfiltered data being passed to CREATE and ALTER SQL queries, with a specific relation to GBK in CHARACTER SET and COLLATE clauses. The vulnerability allows...