CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2017-11327
https://notcve.org/view.php?id=CVE-2017-11327
An issue was discovered in Tilde CMS 1.0.1. It is possible to retrieve sensitive data by using direct references. A low-privileged user can load PHP resources such as admin/content.php and admin/content.php?method=ftp_upload. Se detectó un problema en Tilde CMS versión 1.0.1. • https://backbox.org/membership/sharing-board/tilde-cms-v1-01-multiple-vulnerabilities • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2017-11325
https://notcve.org/view.php?id=CVE-2017-11325
An issue was discovered in Tilde CMS 1.0.1. Arbitrary files can be read via a file=../ attack on actionphp/download.File.php. Se detectó un problema en Tilde CMS versión 1.0.1. Los archivos arbitrarios se pueden leer por medio de un ataque file=../ en actionphp/download.File.php. • https://backbox.org/membership/sharing-board/tilde-cms-v1-01-multiple-vulnerabilities • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2017-11326
https://notcve.org/view.php?id=CVE-2017-11326
An issue was discovered in Tilde CMS 1.0.1. It is possible to bypass the implemented restrictions on arbitrary file upload via a filename.+php manipulation. Se ha descubierto un problema en Tilde CMS 1.0.1. Es posible omitir las restricciones implementadas en la subida de archivos arbitrarios mediante una manipulación filename. • https://backbox.org/membership/sharing-board/tilde-cms-v1-01-multiple-vulnerabilities • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-6509
https://notcve.org/view.php?id=CVE-2017-6509
Smith0r/burgundy-cms before 2017-03-06 is vulnerable to a reflected XSS in admin/components/menu/views/menuitems.php (id parameter). Smith0r/burgundy-cms en versiones anteriores a 2017-03-06 es vulnerable a XSS reflejado en admin/components/menu/views/menuitems.php (parámetro id). • https://github.com/Smith0r/burgundy-cms/issues/36 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2015-4678
https://notcve.org/view.php?id=CVE-2015-4678
SQL injection vulnerability in Persian Car CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to the default URI. Vulnerabilidad de inyección SQL en Persian Car CMS 1.0 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro cat_id en la URI por defecto. • http://packetstormsecurity.com/files/132216/Persian-Car-CMS-1.0-SQL-Injection.html http://www.securityfocus.com/bid/75345 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •