CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-4743 – Dreamer CMS file access
https://notcve.org/view.php?id=CVE-2023-4743
03 Sep 2023 — A vulnerability was found in Dreamer CMS up to 4.1.3. It has been classified as problematic. Affected is an unknown function of the file /upload/ueditorConfig?action=config. The manipulation leads to files or directories accessible. • https://github.com/FFR66/Dreamer-CMS_Unauthorized-access-vulnerability • CWE-552: Files or Directories Accessible to External Parties •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-2473 – Dreamer CMS Password Hash Calculation UserController.java updatePwd algorithmic complexity
https://notcve.org/view.php?id=CVE-2023-2473
02 May 2023 — A vulnerability was found in Dreamer CMS up to 4.1.3. It has been declared as problematic. This vulnerability affects the function updatePwd of the file UserController.java of the component Password Hash Calculation. The manipulation leads to inefficient algorithmic complexity. The attack can be initiated remotely. • https://gitee.com/isoftforce/dreamer_cms/issues/I6WHO7 • CWE-407: Inefficient Algorithmic Complexity •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27084
https://notcve.org/view.php?id=CVE-2023-27084
16 Mar 2023 — Permissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to obtain sensitive information via the AttachmentController parameter. • https://gitee.com/isoftforce/dreamer_cms/issues/I6GCUN • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-0513 – isoftforce Dreamer CMS cross site scripting
https://notcve.org/view.php?id=CVE-2023-0513
26 Jan 2023 — A vulnerability has been found in isoftforce Dreamer CMS up to 4.0.1 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. • https://gitee.com/isoftforce/dreamer_cms/issues/I68UYM • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 2CVE-2022-42245 – Dreamer CMS 4.0.0 SQL Injection
https://notcve.org/view.php?id=CVE-2022-42245
17 Nov 2022 — Dreamer CMS 4.0.01 is vulnerable to SQL Injection. Dreamer CMS 4.0.01 es vulnerable a la inyección SQL. Dreamer CMS version 4.0.0 suffers from a remote SQL injection vulnerability. • https://packetstorm.news/files/id/171585 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •