CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-21643 – SQL Injection in USOC
https://notcve.org/view.php?id=CVE-2022-21643
USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via register.php. In particular usernames, email addresses, and passwords provided by the user were not sanitized and were used directly to construct a sql statement. Users are advised to upgrade as soon as possible. There are not workarounds for this issue. • https://github.com/Aaron-Junker/USOC/commit/21e8bfd7a9ab0b7f9344a7a3a7c32a7cdd5a0b69 https://github.com/Aaron-Junker/USOC/security/advisories/GHSA-fjp4-phjh-jgmc • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-15564
https://notcve.org/view.php?id=CVE-2018-15564
An issue was discovered in daveismyname simple-cms through 2014-03-11. There is a CSRF vulnerability that can delete any page via admin/?delpage=8. Se ha descubierto un problema en daveismyname simple-cms hasta el 11/03/2014. Hay una vulnerabilidad de Cross-Site Request Forgery (CSRF) que puede eliminar cualquier página mediante admin/? • https://github.com/daveismyname/simple-cms/issues/4 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-15565
https://notcve.org/view.php?id=CVE-2018-15565
An issue was discovered in daveismyname simple-cms through 2014-03-11. admin/addpage.php does not require authentication for adding a page. This can also be exploited via CSRF. Se ha descubierto un problema en daveismyname simple-cms hasta el 11/03/2014 en el que admin/addpage.php no requiere la autenticación para añadir una página. Esto también se puede explotar mediante Cross-Site Request Forgery (CSRF). • https://github.com/daveismyname/simple-cms/issues/2 https://github.com/daveismyname/simple-cms/issues/3 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 13%CPEs: 1EXPL: 2CVE-2008-2267 – CMS Made Simple 1.2.4 Module FileManager - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2008-2267
Incomplete blacklist vulnerability in javaUpload.php in Postlet in the FileManager module in CMS Made Simple 1.2.4 and earlier allows remote attackers to execute arbitrary code by uploading a file with a name ending in (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, or (7) .jar, then accessing it via a direct request to the file in modules/FileManager/postlet/. Vulnerabilidad de lista negra incompleta en javaUpload.php de Postlet en el módulo FileManager de CMS Made Simple 1.2.4 y versiones anteriores permite a atacantes remotos ejecutar código de su elección mediante la subida de un fichero con un nombre finalizado en (1) .jsp, (2) .php3, (3) .cgi, (4) .dhtml, (5) .phtml, (6) .php5, o (7) .jar, entonces accede a través de una petición directa a el fichero en modules/FileManager/postlet/. • https://www.exploit-db.com/exploits/5600 http://blog.cmsmadesimple.org/2008/05/12/announcing-cms-made-simple-125 http://secunia.com/advisories/30208 http://www.attrition.org/pipermail/vim/2008-May/001978.html http://www.securityfocus.com/bid/29170 https://exchange.xforce.ibmcloud.com/vulnerabilities/42371 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2008-0835 – Simple CMS 1.0.3 - 'area' SQL Injection
https://notcve.org/view.php?id=CVE-2008-0835
SQL injection vulnerability in indexen.php in Simple CMS 1.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the area parameter. Vulnerabilidad de Inyección SQL en Simple CMS 1.0.3 y anteriores, que permite a atacantes remotos ejecutar comandos Vulnerabilidad de Inyección SQL de su elección a través del parámetro "area". • https://www.exploit-db.com/exploits/5131 http://www.securityfocus.com/archive/1/488288/100/0/threaded http://www.securityfocus.com/bid/27843 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •