CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-34917
https://notcve.org/view.php?id=CVE-2023-34917
31 Jul 2023 — Fuge CMS v1.0 contains an Open Redirect vulnerability in member/RegisterAct.java. • https://github.com/fuge/cms/issues/3 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 3CVE-2022-45544
https://notcve.org/view.php?id=CVE-2022-45544
07 Feb 2023 — Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and execute arbitrary code via the tristao parameter. NOTE: this is disputed by the vendor because an admin is intentionally allowed to upload new executable PHP code, such as a theme that was obtained from a trusted source or was developed for their own website. Only an admin can upload such code, not someone else in an "attacker" role. • https://github.com/tristao-marinho/CVE-2022-45544 • CWE-863: Incorrect Authorization •
CVSS: 7.2EPSS: 3%CPEs: 1EXPL: 0CVE-2019-11021
https://notcve.org/view.php?id=CVE-2019-11021
24 Oct 2019 — admin/app/mediamanager in Schlix CMS 2.1.8-7 allows Authenticated Unrestricted File Upload, leading to remote code execution. NOTE: "While inadvertently allowing a PHP file to be uploaded via Media Manager was an oversight, it still requires an admin permission. We think it's pretty rare for an administrator to exploit a bug on his/her own site to own his/her own site. ** EN DISPUTA ** El archivo admin/app/mediamanager en Schlix CMS versión 2.1.8-7, permite una carga de archivos sin restricciones autenticad... • https://gurelahmet.com/schlix-cms-v2-1-8-7-authenticated-unrestricted-file-upload-to-rce • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11198
https://notcve.org/view.php?id=CVE-2019-11198
05 Aug 2019 — Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List Manager Dashboard module, (2) #307638 - Campaign Creator module, (3) #316994 - Attributes field, (4) I#316995 - Icon Selection module, (5) #317000 - Latitude field, (6) #317000 - Longitude field, (7) #317017 - UploadPackage2.aspx module, (8) #317072 - Context menu, or (9) I#317073 - Insert from Template dialog. Múltiples vulnerabilidad... • https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/92/Sitecore%20Experience%20Platform%2092%20Initial%20Release/Release%20Notes • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 15%CPEs: 1EXPL: 1CVE-2019-9875 – Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
https://notcve.org/view.php?id=CVE-2019-9875
31 May 2019 — Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter. La deserialización de datos no confiables en el módulo anti CSRF en Sitecore hasta la versón 9.1, permite a un atacante identificado ejecutar código arbitrario mediante el envío un objeto .NET serializado dentro de un parámetro POST de HTTP. Sitecore CMS and Experience Platform (XP) contain a deserializatio... • https://dev.sitecore.net/Downloads.aspx • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2014-100004
https://notcve.org/view.php?id=CVE-2014-100004
13 Jan 2015 — Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev. 140120) allows remote attackers to inject arbitrary web script or HTML via the xmlcontrol parameter to the default URI. NOTE: some of these details are obtained from third party information. Vulnerabilidad de XSS en Sitecore CMS anterior a 7.0 actualización-4 (rev. 140120) permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro xmlcontrol en la URI por defecto. NOTA: algunos d... • http://osvdb.org/102660 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 7%CPEs: 1EXPL: 2CVE-2012-5919 – Havalite CMS 1.0.4 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-5919
19 Nov 2012 — Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) find or (2) replace fields to havalite/findReplace.php; (3) username parameter to havalite/hava_login.php, (4) the Edit Article module, or (5) hava_post.php in the postAuthor module; (6) postId parameter to hava_post.php; (7) userId parameter to hava_user.php; or (8) linkId parameter to hava_link.php. Múltiples vulnerabilidades de ejecución de secuencias... • https://www.exploit-db.com/exploits/18772 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2012-5892
https://notcve.org/view.php?id=CVE-2012-5892
17 Nov 2012 — Havalite CMS 1.1.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the configuration database via a direct request for data/havalite.db3. Havalite CMS v1.1.0 y anteriores almacena la información sensible bajo la raíz web con un control de acceso insuficiente, lo que permite a atacantes remotos descargar la base de datos de configuración a través de una petición directa a data/havalite.db3. • http://osvdb.org/80770 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 1CVE-2012-5893
https://notcve.org/view.php?id=CVE-2012-5893
17 Nov 2012 — Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary code by uploading a file with a .php;.gif extension, then accessing it via a direct request to the file in tmp/files/. Una vulnerabilidad de subida de archivos sin restricciones en hava_upload.php en Havalite CMS v1.1.0 y anteriores permite a atacantes remotos ejecutar código de su elección mediante la carga de un archivo con una extensión php, o gif, para luego acceder al... • http://osvdb.org/80768 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2012-5894 – Havalite CMS 1.0.4 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2012-5894
17 Nov 2012 — SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the postId parameter. Vulnerabilidad de inyección SQL en hava_post.php en Havalite CMS v1.1.0 y anteriores permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro postid. • https://www.exploit-db.com/exploits/18772 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •