CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-12666 – ClassCMS User Management Page admin insufficient privileges
https://notcve.org/view.php?id=CVE-2024-12666
16 Dec 2024 — A vulnerability has been found in ClassCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin?do=admin:user:editPost of the component User Management Page. The manipulation leads to improper handling of insufficient privileges. The attack can be launched remotely. • https://github.com/Jack-Black-13/blob/blob/main/ClassCMS%20V4.8%20Vertical%20Privilege%20Escalation.md • CWE-266: Incorrect Privilege Assignment CWE-274: Improper Handling of Insufficient Privileges •
CVSS: 5.1EPSS: 0%CPEs: 1EXPL: 1CVE-2024-12503 – ClassCMS Model Management Page admin cross site scripting
https://notcve.org/view.php?id=CVE-2024-12503
12 Dec 2024 — A vulnerability classified as problematic was found in ClassCMS 4.8. Affected by this vulnerability is an unknown functionality of the file /index.php/admin of the component Model Management Page. The manipulation of the argument URL leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. • https://github.com/Jack-Black-13/blob/blob/main/classCMS_v4.8_model_xss.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-48180
https://notcve.org/view.php?id=CVE-2024-48180
16 Oct 2024 — ClassCMS <=4.8 is vulnerable to file inclusion in the nowView method in/class/cms/cms.php, which can include a file uploaded to the/class/template directory to execute PHP code. ClassCMS <=4.8 es vulnerable a la inclusión de archivos en el método nowView in/class/cms/cms.php, que puede incluir un archivo cargado en el directorio the/class/template para ejecutar código PHP. • https://github.com/J-0k3r/CVE-2024-48180 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.1EPSS: 0%CPEs: 1EXPL: 1CVE-2024-8145 – ClassCMS Article admin cross site scripting
https://notcve.org/view.php?id=CVE-2024-8145
25 Aug 2024 — A vulnerability, which was classified as problematic, has been found in ClassCMS 4.8. Affected by this issue is some unknown functionality of the file /index.php/admin of the component Article Handler. The manipulation of the argument Title leads to basic cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. • https://github.com/acmglz/bug2_report/blob/main/classcms_url_jump.md • CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2024-8144 – ClassCMS Logo admin cross site scripting
https://notcve.org/view.php?id=CVE-2024-8144
25 Aug 2024 — A vulnerability classified as problematic was found in ClassCMS 4.8. Affected by this vulnerability is an unknown functionality of the file /index.php/admin of the component Logo Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. • https://github.com/acmglz/bug2_report/blob/main/classcms_xss.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 1CVE-2024-6932 – ClassCMS cross site scripting
https://notcve.org/view.php?id=CVE-2024-6932
20 Jul 2024 — A vulnerability was found in ClassCMS 4.5. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/?action=home&do=shop:index&keyword=&kind=all. The manipulation of the argument order leads to cross site scripting. • https://github.com/Hebing123/cve/issues/42 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2022-45966
https://notcve.org/view.php?id=CVE-2022-45966
22 Dec 2022 — here is an arbitrary file upload vulnerability in the file management function module of Classcms3.5. Aquí hay una vulnerabilidad de carga de archivos arbitraria en el módulo de función de administración de archivos de Classcms3.5. • https://github.com/yinfei6/classcms • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-25582
https://notcve.org/view.php?id=CVE-2022-25582
25 Mar 2022 — A stored cross-site scripting (XSS) vulnerability in the Column module of ClassCMS v2.5 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Add Articles field. Una vulnerabilidad de tipo cross-site scripting (XSS) almacenado en el módulo Column de ClassCMS versiones v2.5 y anteriores, permite a atacantes ejecutar scripts web o HTML arbitrarios por medio de una carga útil diseñada inyectada en el campo Add Articles • https://github.com/k0xx11/Vulscve/blob/master/classcms2.5-xss.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-25581
https://notcve.org/view.php?id=CVE-2022-25581
18 Mar 2022 — Classcms v2.5 and below contains an arbitrary file upload via the component \class\classupload. This vulnerability allows attackers to execute code injection via a crafted .txt file. Classcms versionesv2.5 y anteriores, contienen una carga de archivos arbitraria por medio del componente \class\classupload. Esta vulnerabilidad permite a atacantes ejecutar una inyección de código por medio de un archivo .txt diseñado • https://github.com/k0xx11/Vulscve/blob/master/classcms2.5-rce.md • CWE-434: Unrestricted Upload of File with Dangerous Type •