Vulnerabilidades

An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting -> Mailbox configuration -> Registration email template" screen, and uploading an image file, as demonstrated by a .php filename and the "Content-Type: image/gif" header.

HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI.

admin/?/plugin/file_manager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element.

Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field.

Frog CMS 0.9.5 provides a directory listing for a /public request.

admin/?/plugin/file_manager in Frog CMS 0.9.5 allows PHP code execution by creating a new .php file containing PHP code, and then visiting this file under the public/ URI.

Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field.

Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional <?php lines.

Frog CMS 0.9.5 allows PHP code execution via <?php to the admin/?/layout/edit/1 URI.

An issue was discovered in baijiacms V4 that can result in time-based blind SQL injection to get data via the cate parameter in an index.php?act=index request.

Frog CMS 0.9.5 allows XSS via the forgot password page (aka the /admin/?/login/forgot URI).

Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field.

No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article "keyword" parameter.

No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article/index/ "article_title" parameter.

FROG CMS 0.9.5 has XSS via the admin/?/snippet/add name parameter, which is mishandled during an edit action, a related issue to CVE-2018-10319.

UCMS 1.4.7 has XSS via the description parameter in an index.php list_editpost action.

sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmin_cedit action.

UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadmin_fileedit action.

UCMS 1.4.7 has ?do=user_addpost CSRF.

UCMS 1.4.7 has XSS via the dir parameter in an index.php sadmin_fileedit action.

Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.

An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the title parameter.

An issue was discovered in tp5cms through 2017-05-25. admin.php/upload/picture.html allows remote attackers to execute arbitrary PHP code by uploading a .php file with the image/jpeg content type.

An issue was discovered in arcms through 2018-03-19. SQL injection exists via the json/newslist limit parameter because of ctl/main/Json.php, ctl/main/service/Data.php, and comp/Db/Mysql.php.

An issue was discovered in arcms through 2018-03-19. No authentication is required for index/main, user/useradd, or img/images.