CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-2354 – Dreamer CMS toEdit cross-site request forgery
https://notcve.org/view.php?id=CVE-2024-2354
10 Mar 2024 — A vulnerability, which was classified as problematic, was found in Dreamer CMS 4.1.3. Affected is an unknown function of the file /admin/menu/toEdit. The manipulation of the argument id leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. • https://github.com/sweatxi/BugHub/blob/main/dreamer_cms_admin_menu_toEdit_csrf.pdf • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-31505
https://notcve.org/view.php?id=CVE-2023-31505
31 Jan 2024 — An arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated attackers to execute arbitrary code and obtain sensitive information via a crafted .phtml file. Una vulnerabilidad de carga de archivos arbitrarios en Schlix CMS v2.2.8-1 permite a atacantes remotos autenticados ejecutar código arbitrario y obtener información confidencial a través de un archivo .phtml manipulado. • https://m3n0sd0n4ld.github.io/patoHackventuras/cve-2023-31505 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-46906
https://notcve.org/view.php?id=CVE-2023-46906
09 Jan 2024 — juzaweb <= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated. juzaweb <= 3.4 es vulnerable a un control de acceso incorrecto, lo que provoca una interrupción de la aplicación después de un código de estado HTTP 500. El payload en el campo de timezone no se validó correctamente. • https://github.com/juzaweb/cms • CWE-863: Incorrect Authorization •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-46467
https://notcve.org/view.php?id=CVE-2023-46467
28 Oct 2023 — Cross Site Scripting vulnerability in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter of the registration page. Vulnerabilidad de Cross-Site Scripting (XSS) en juzawebCMS v.3.4 y anteriores permite a un atacante remoto ejecutar código arbitrario a través de un payload manipulado en el parámetro de nombre de usuario de la página de registro. • https://www.sumor.top/index.php/archives/872 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-24804
https://notcve.org/view.php?id=CVE-2020-24804
11 Aug 2023 — Plaintext Password vulnerability in AddAdmin.py in cms-dev/cms v1.4.rc1, allows attackers to gain sensitive information via audit logs. • https://github.com/cms-dev/cms/issues/1160 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-34916
https://notcve.org/view.php?id=CVE-2023-34916
31 Jul 2023 — Fuge CMS v1.0 contains an Open Redirect vulnerability via /front/ProcessAct.java. • https://github.com/fuge/cms/issues/4 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-34917
https://notcve.org/view.php?id=CVE-2023-34917
31 Jul 2023 — Fuge CMS v1.0 contains an Open Redirect vulnerability in member/RegisterAct.java. • https://github.com/fuge/cms/issues/3 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 3CVE-2022-45544
https://notcve.org/view.php?id=CVE-2022-45544
07 Feb 2023 — Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and execute arbitrary code via the tristao parameter. NOTE: this is disputed by the vendor because an admin is intentionally allowed to upload new executable PHP code, such as a theme that was obtained from a trusted source or was developed for their own website. Only an admin can upload such code, not someone else in an "attacker" role. • https://github.com/tristao-marinho/CVE-2022-45544 • CWE-863: Incorrect Authorization •
CVSS: 9.9EPSS: 79%CPEs: 23EXPL: 3CVE-2020-7357 – Cayin CMS Command Injection
https://notcve.org/view.php?id=CVE-2020-7357
18 Jun 2020 — Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-40, CMS-20, and CMS version 8.2, 8.0, and 7.5. Cayin CMS sufre de una vulnerabilidad de inyección de comando semi-ciega autenticada del Sistem... • https://packetstorm.news/files/id/158139 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.2EPSS: 3%CPEs: 1EXPL: 0CVE-2019-11021
https://notcve.org/view.php?id=CVE-2019-11021
24 Oct 2019 — admin/app/mediamanager in Schlix CMS 2.1.8-7 allows Authenticated Unrestricted File Upload, leading to remote code execution. NOTE: "While inadvertently allowing a PHP file to be uploaded via Media Manager was an oversight, it still requires an admin permission. We think it's pretty rare for an administrator to exploit a bug on his/her own site to own his/her own site. ** EN DISPUTA ** El archivo admin/app/mediamanager en Schlix CMS versión 2.1.8-7, permite una carga de archivos sin restricciones autenticad... • https://gurelahmet.com/schlix-cms-v2-1-8-7-authenticated-unrestricted-file-upload-to-rce • CWE-434: Unrestricted Upload of File with Dangerous Type •