CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 3CVE-2020-24223 – Mara CMS 7.5 - Reflective Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2020-24223
Mara CMS 7.5 allows cross-site scripting (XSS) in contact.php via the theme or pagetheme parameters. Mara CMS 7.5 permite el cross-site scripting (XSS) en contact.php a través de los parámetros theme o pagetheme Mara CMS version 7.5 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/48777 http://packetstormsecurity.com/files/158728/Mara-CMS-7.5-Cross-Site-Scripting.html https://github.com/FreySolarEye/CVE/blob/master/Mara%20CMS%207.5%20-%20Cross%20Site%20Scripting • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-15599 – Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2020-15599
Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field. Victor CMS hasta el 28-02-2019, permite un ataque de tipo XSS por medio del campo user_firstname o user_lastname del archivo register.php • https://www.exploit-db.com/exploits/48626 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-8641
https://notcve.org/view.php?id=CVE-2020-8641
Lotus Core CMS 1.0.1 allows authenticated Local File Inclusion of .php files via directory traversal in the index.php page_slug parameter. Lotus Core CMS versión 1.0.1, permite una Inclusión de Archivos Locales autenticada de archivos .php por medio del salto de directorio en el parámetro page_slug del archivo index.php. • https://www.exploit-db.com/exploits/47985 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-17521
https://notcve.org/view.php?id=CVE-2019-17521
An issue was discovered in Landing-CMS 0.0.6. There is a CSRF vulnerability that can change the admin's password via the password/ URI, Se detectó un problema en Landing-CMS versión 0.0.6. Se presenta una vulnerabilidad CSRF que puede cambiar la contraseña del administrador por medio del URI password/. • https://github.com/Elias-Black/Landing-CMS/issues/8 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-17429
https://notcve.org/view.php?id=CVE-2019-17429
Adhouma CMS through 2019-10-09 has SQL Injection via the post.php p_id parameter. Adhouma CMS hasta el 09-10-2019, presenta una inyección SQL por medio del parámetro p_id del archivo post.php. • https://github.com/Adhouma/cms/issues/1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •