CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-26231
https://notcve.org/view.php?id=CVE-2021-26231
22 Jul 2021 — SQL injection vulnerability in SourceCodester Fantastic Blog CMS v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to category.php. Una vulnerabilidad de inyección SQL en SourceCodester Fantastic Blog CMS versión v1.0, permite a atacantes remotos ejecutar sentencias SQL arbitrarias, por medio del parámetro id en el archivo category.php • https://github.com/BigTiger2020/Fantastic-Blog-CMS-/blob/main/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-29147
https://notcve.org/view.php?id=CVE-2020-29147
14 Jul 2021 — A SQL injection vulnerability in wy_controlls/wy_side_visitor.php of Wayang-CMS v1.0 allows attackers to obtain sensitive database information. Una vulnerabilidad de inyección SQL en la función wy_controlls/ en el archivo wy_side_visitor.php de Wayang-CMS versión v1.0, permite a atacantes obtener información confidencial de la base de datos • https://lowliness9.me/post/Ma16ZrNDN • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-29146
https://notcve.org/view.php?id=CVE-2020-29146
14 Jul 2021 — A cross site scripting (XSS) vulnerability in index.php of Wayang-CMS v1.0 allows attackers to execute arbitrary web scripts or HTML via a constructed payload created by adding the X-Forwarded-For field to the header. Una vulnerabilidad de tipo cross site scripting (XSS) en el archivo index.php de Wayang-CMS versión v1.0, permite a atacantes ejecutar scripts web o HTML arbitrario por medio de una carga útil creada al añadir el campo X-Fordered-For al encabezado • https://lowliness9.me/post/iDACsrRWO • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2020-29280
https://notcve.org/view.php?id=CVE-2020-29280
02 Dec 2020 — The Victor CMS v1.0 application is vulnerable to SQL injection via the 'search' parameter on the search.php page. La aplicación Victor CMS versión v1.0, es vulnerable a una inyección SQL por medio del parámetro "search" en la página search.php • https://github.com/BigTiger2020/Victor-CMS-/blob/main/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-23945
https://notcve.org/view.php?id=CVE-2020-23945
27 Oct 2020 — A SQL injection vulnerability exists in Victor CMS V1.0 in the cat_id parameter of the category.php file. This parameter can be used by sqlmap to obtain data information in the database. Se presenta una vulnerabilidad de inyección SQL en Victor CMS versión V1.0, en el parámetro cat_id del archivo category.php. Este parámetro puede ser usado por sqlmap para conseguir información de datos en la base de datos • https://github.com/VictorAlagwu/CMSsite/issues/14 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-11198
https://notcve.org/view.php?id=CVE-2019-11198
05 Aug 2019 — Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List Manager Dashboard module, (2) #307638 - Campaign Creator module, (3) #316994 - Attributes field, (4) I#316995 - Icon Selection module, (5) #317000 - Latitude field, (6) #317000 - Longitude field, (7) #317017 - UploadPackage2.aspx module, (8) #317072 - Context menu, or (9) I#317073 - Insert from Template dialog. Múltiples vulnerabilidad... • https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/92/Sitecore%20Experience%20Platform%2092%20Initial%20Release/Release%20Notes • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 15%CPEs: 1EXPL: 1CVE-2019-9875 – Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
https://notcve.org/view.php?id=CVE-2019-9875
31 May 2019 — Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter. La deserialización de datos no confiables en el módulo anti CSRF en Sitecore hasta la versón 9.1, permite a un atacante identificado ejecutar código arbitrario mediante el envío un objeto .NET serializado dentro de un parámetro POST de HTTP. Sitecore CMS and Experience Platform (XP) contain a deserializatio... • https://dev.sitecore.net/Downloads.aspx • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 3CVE-2018-17391 – Super Cms Blog Pro 1.0 - SQL Injection
https://notcve.org/view.php?id=CVE-2018-17391
25 Sep 2018 — SQL Injection exists in authors_post.php in Super Cms Blog Pro 1.0 via the author parameter. Existe una inyección SQL en authors_post.php en Super Cms Blog Pro 1.0 mediante el parámetro author. Super Cms Blog Pro version 1.0 suffers from a remote SQL injection vulnerability. • https://packetstorm.news/files/id/149519 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2018-5969 – Photography CMS 1.0 - Cross-Site Request Forgery (Add Admin)
https://notcve.org/view.php?id=CVE-2018-5969
24 Jan 2018 — Cross Site Request Forgery (CSRF) exists in Photography CMS 1.0 via clients/resources/ajax/ajax_new_admin.php, as demonstrated by adding an admin account. Existe Cross-Site Request Forgery (CSRF) en Photography CMS 1.0 mediante clients/resources/ajax/ajax_new_admin.php, tal y como demuestra la adición de una cuenta admin. Photography CMS version 1.0 suffers from a cross site request forgery vulnerability. • https://packetstorm.news/files/id/146055 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 2CVE-2017-17607 – CMS Auditor Website 1.0 - SQL Injection
https://notcve.org/view.php?id=CVE-2017-17607
13 Dec 2017 — CMS Auditor Website 1.0 has SQL Injection via the PATH_INFO to /news-detail. CMS Auditor Website 1.0 tiene una inyección SQL mediante el parámetro PATH_INFO en /news-detail. • https://www.exploit-db.com/exploits/43272 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •