CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-37785
https://notcve.org/view.php?id=CVE-2023-37785
A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the smile_code parameter of the component /editprofile.php. Una vulnerabilidad de tipo Cross-Site Scripting (XSS) en ImpressCMS v1.4.5 y anteriores permite a los atacantes ejecutar scripts web o HTML arbitrarios a través de un payload manipulado inyectado en el parámetro "smile_code" del componente "/editprofile.php". • https://github.com/CrownZTX/cve-description • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 2CVE-2022-26986 – ImpressCMS v1.4.3 - Authenticated SQL Injection
https://notcve.org/view.php?id=CVE-2022-26986
SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system. Una inyección SQL en ImpressCMS versiones 1.4.3 y anteriores, permite a atacantes remotos inyectar en el código de forma no intencionada, esto permite a un atacante leer y modificar la información confidencial de la base de datos utilizada por la aplicación. Si es configurada inapropiadamente, un atacante puede incluso cargar una shell web maliciosa para comprometer todo el sistema ImpressCMS version 1.4.3 suffers from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/51056 http://packetstormsecurity.com/files/171485/ImpressCMS-1.4.3-SQL-Injection.html https://github.com/sartlabs/0days/blob/main/ImpressCMS1.4.3/Exploit.txt • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 4CVE-2021-26599 – ImpressCMS 1.4.2 - Remote Code Execution (RCE)
https://notcve.org/view.php?id=CVE-2021-26599
ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection. ImpressCMS versiones anteriores a 1.4.3, permite una inyección SQL de los grupos include/findusers.php ImpressCMS versions 1.4.3 and below suffer from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/50839 http://karmainsecurity.com/KIS-2022-04 http://packetstormsecurity.com/files/166404/ImpressCMS-1.4.2-SQL-Injection.html http://seclists.org/fulldisclosure/2022/Mar/46 https://hackerone.com/reports/1081145 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 4%CPEs: 1EXPL: 4CVE-2021-26598 – ImpressCMS 1.4.2 SQL Injection / Remote Code Execution
https://notcve.org/view.php?id=CVE-2021-26598
ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token). ImpressCMS versiones anteriores a 1.4.3, presenta un Control de Acceso Incorrecto porque el archivo include/findusers.php permite el acceso de atacantes no autenticados (que son, por diseño, capaces de tener un token de seguridad) ImpressCMS versions 1.4.2 and below suffer from an incorrect access control vulnerability. • http://karmainsecurity.com/KIS-2022-03 http://seclists.org/fulldisclosure/2022/Mar/45 https://hackerone.com/reports/1081137 https://packetstormsecurity.com/files/166403/ImpressCMS-1.4.2-Incorrect-Access-Control.html • CWE-287: Improper Authentication •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 3CVE-2021-26601 – ImpressCMS 1.4.2 Path Traversal
https://notcve.org/view.php?id=CVE-2021-26601
ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal. ImpressCMS versiones anteriores a 1.4.3, permite un Salto de Directorio libraries/image-editor/image-edit.php image_temp ImpressCMS versions 1.4.2 and below suffer from a path traversal vulnerability that can allow for arbitrary file deletion. • http://karmainsecurity.com/KIS-2022-02 http://packetstormsecurity.com/files/166402/ImpressCMS-1.4.2-Path-Traversal.html http://seclists.org/fulldisclosure/2022/Mar/44 https://hackerone.com/reports/1081878 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •