CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-23873
https://notcve.org/view.php?id=CVE-2022-23873
03 Feb 2022 — Victor CMS v1.0 was discovered to contain a SQL injection vulnerability that allows attackers to inject arbitrary commands via 'user_firstname' parameter. Se ha detectado que Victor CMS versión v1.0, contiene una vulnerabilidad de inyección SQL que permite a atacantes inyectar comandos arbitrarios por medio del parámetro "user_firstname" • https://github.com/truonghuuphuc/CVE • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-46459
https://notcve.org/view.php?id=CVE-2021-46459
31 Jan 2022 — Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=add_user. These vulnerabilities can be exploited through a crafted POST request via the user_name, user_firstname,user_lastname, or user_email parameters. Se ha detectado que Victor CMS versión v1.0, contiene múltiples vulnerabilidades de inyección SQL en el componente admin/users.php?source=add_user. • https://github.com/Nguyen-Trung-Kien/CVE • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-46458
https://notcve.org/view.php?id=CVE-2021-46458
31 Jan 2022 — Victor CMS v1.0 was discovered to contain a SQL injection vulnerability in the component admin/posts.php?source=add_post. This vulnerability can be exploited through a crafted POST request via the post_title parameter. Se ha detectado que Victor CMS versión v1.0, contiene una vulnerabilidad de inyección SQL en el componente admin/posts.php?source=add_post. • https://github.com/Nguyen-Trung-Kien/CVE • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-20605
https://notcve.org/view.php?id=CVE-2020-20605
22 Dec 2021 — Blog CMS v1.0 contains a cross-site scripting (XSS) vulnerability in the /controller/CommentAdminController.java component. Blog CMS versiónv1.0 contiene una vulnerabilidad de tipo cross-site scripting (XSS) en el componente /controller/CommentAdminController.java • https://github.com/xuzijia/blog/issues/4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-18263
https://notcve.org/view.php?id=CVE-2020-18263
03 Nov 2021 — PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability in the component search.php via the search parameter. This vulnerability allows attackers to access sensitive database information. Se ha detectado que PHP-CMS versión v1.0, contiene una vulnerabilidad de inyección SQL en el componente search.php por medio del parámetro search. Esta vulnerabilidad permite a atacantes acceder a información confidencial de la base de datos • https://github.com/harshitbansal373/PHP-CMS/issues/1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-18261
https://notcve.org/view.php?id=CVE-2020-18261
03 Nov 2021 — An arbitrary file upload vulnerability in the image upload function of ED01-CMS v1.0 allows attackers to execute arbitrary commands. Una vulnerabilidad de carga de archivos arbitraria en la función image upload de ED01-CMS versión v1.0, permite a atacantes ejecutar comandos arbitrarios • https://github.com/chilin89117/ED01-CMS/issues/2 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-18262
https://notcve.org/view.php?id=CVE-2020-18262
03 Nov 2021 — ED01-CMS v1.0 was discovered to contain a SQL injection in the component cposts.php via the cid parameter. Se ha detectado que ED01-CMS versión v1.0, contiene una inyección SQL en el componente cposts.php por medio del parámetro cid • https://github.com/chilin89117/ED01-CMS/issues/3 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-18259
https://notcve.org/view.php?id=CVE-2020-18259
03 Nov 2021 — ED01-CMS v1.0 was discovered to contain a reflective cross-site scripting (XSS) vulnerability in the component sposts.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the Post title or Post content fields. Se ha detectado que ED01-CMS versión v1.0, contiene una vulnerabilidad de tipo cross-site scripting (XSS) reflectiva en el componente sposts.php. Esta vulnerabilidad permite a atacantes ejecutar scripts web o HTML arbitrarios por medio d... • https://github.com/chilin89117/ED01-CMS/issues/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 0CVE-2020-21865
https://notcve.org/view.php?id=CVE-2020-21865
07 Oct 2021 — ThinkPHP50-CMS v1.0 contains a remote code execution (RCE) vulnerability in the component /public/?s=captcha. ThinkPHP50-CMS versión v1.0, contiene una vulnerabilidad de ejecución de código remota (RCE) en el componente /public/?s=captcha • https://github.com/nnngu/ThinkPHP50-CMS/issues/1 •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2021-25203
https://notcve.org/view.php?id=CVE-2021-25203
23 Jul 2021 — Arbitrary file upload vulnerability in Victor CMS v 1.0 allows attackers to execute arbitrary code via the file upload to \CMSsite-master\admin\includes\admin_add_post.php. Una vulnerabilidad de carga de archivos arbitrarios en Victor CMS versión v1.0, permite a atacantes ejecutar código arbitrario por medio de la carga de archivos a \CMSsite-master\admin\includes\admin_add_post.php • https://github.com/TCSWT/Victor-CMS/blob/main/README.md • CWE-434: Unrestricted Upload of File with Dangerous Type •