Page 2 of 30 results (0.005 seconds)

CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1

CVE-2022-45040

https://notcve.org/view.php?id=CVE-2022-45040

25 Nov 2022 — A cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name Section field. Una vulnerabilidad de cross-site scripting (XSS) en /admin/pages/sections_save.php de WBCE CMS v1.5.4 permite a los atacantes ejecutar scrpts web o HTML de su elección a través de un payload manipulado inyectado en el campo Sección de nombre. • https://shimo.im/docs/XKq4MKmDGnsgjZkN • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2022-45012

https://notcve.org/view.php?id=CVE-2022-45012

21 Nov 2022 — A cross-site scripting (XSS) vulnerability in the Modify Page module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Source field. Una vulnerabilidad de cross-site scripting (XSS) en el módulo Modificar página de WBCE CMS v1.5.4 permite a los atacantes ejecutar scripts web o HTML de su elección a través de un payload manipulado inyectado en el campo Source. • https://github.com/WBCE/WBCE_CMS • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2022-45013

https://notcve.org/view.php?id=CVE-2022-45013

21 Nov 2022 — A cross-site scripting (XSS) vulnerability in the Show Advanced Option module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Section Header field. Una vulnerabilidad de cross-site scripting (XSS) en el módulo Show Advanced Option de WBCE CMS v1.5.4 permite a los atacantes ejecutar scripts web o HTML de su elección a través de un payload manipulado inyectado en el campo Encabezado de sección. • https://github.com/WBCE/WBCE_CMS • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2022-45014

https://notcve.org/view.php?id=CVE-2022-45014

21 Nov 2022 — A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Results Header field. Una vulnerabilidad de cross-site scripting (XSS) en el módulo de configuración de búsqueda de WBCE CMS v1.5.4 permite a los atacantes ejecutar scripts web o HTML de su elección a través de un payload manipulado inyectado en el campo Results Header. • https://github.com/WBCE/WBCE_CMS • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2022-45015

https://notcve.org/view.php?id=CVE-2022-45015

21 Nov 2022 — A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Results Footer field. Una vulnerabilidad de cross-site scripting (XSS) en el módulo de configuración de búsqueda de WBCE CMS v1.5.4 permite a los atacantes ejecutar scripts web o HTML de su elección a través de un payload manipulado inyectado en el campo Pie de página de resultados. • https://github.com/WBCE/WBCE_CMS • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2022-45016

https://notcve.org/view.php?id=CVE-2022-45016

21 Nov 2022 — A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Footer field. Una vulnerabilidad de cross-site scripting (XSS) en el módulo de configuración de búsqueda de WBCE CMS v1.5.4 permite a los atacantes ejecutar scripts web o HTML de su elección a través de un payload manipulado inyectado en el campo Pie de página. • https://github.com/WBCE/WBCE_CMS • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2022-45017

https://notcve.org/view.php?id=CVE-2022-45017

21 Nov 2022 — A cross-site scripting (XSS) vulnerability in the Overview Page settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Loop field. Una vulnerabilidad de cross-site scripting (XSS) en el módulo de configuración de la página de descripción general de WBCE CMS v1.5.4 permite a los atacantes ejecutar scripts web o HTML de su elección a través de un payload manipulado inyectado en el campo Post Loop. • https://github.com/WBCE/WBCE_CMS • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2022-4006 – WBCE CMS Header class.login.php increase_attempts excessive authentication

https://notcve.org/view.php?id=CVE-2022-4006

15 Nov 2022 — A vulnerability, which was classified as problematic, has been found in WBCE CMS. Affected by this issue is the function increase_attempts of the file wbce/framework/class.login.php of the component Header Handler. The manipulation of the argument X-Forwarded-For leads to improper restriction of excessive authentication attempts. The attack may be launched remotely. The name of the patch is d394ba39a7bfeb31eda797b6195fd90ef74b2e75. • https://github.com/WBCE/WBCE_CMS/issues/524 • CWE-307: Improper Restriction of Excessive Authentication Attempts CWE-400: Uncontrolled Resource Consumption •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2

CVE-2022-30072

https://notcve.org/view.php?id=CVE-2022-30072

17 May 2022 — WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \admin\pages\sections_save.php namesection2 parameters. WBCE CMS versión 1.5.2, es vulnerable a un ataque de tipo Cross Site Scripting (XSS) por medio de los parámetros namesection2 del archivo \admin\pages\sections_save.php • https://github.com/APTX-4879/CVE • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2

CVE-2022-30073

https://notcve.org/view.php?id=CVE-2022-30073

17 May 2022 — WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php. WBCE CMS versión 1.5.2, es vulnerable a un ataque de tipo Cross Site Scripting (XSS) por medio del archivo /admin/users/save.php • https://github.com/APTX-4879/CVE • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •