CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-23966
https://notcve.org/view.php?id=CVE-2020-23966
SQL Injection vulnerability in victor cms 1.0 allows attackers to execute arbitrary commands via the post parameter to /post.php in a crafted GET request. • https://github.com/VictorAlagwu/CMSsite https://github.com/VictorAlagwu/CMSsite/issues/15 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-2473 – Dreamer CMS Password Hash Calculation UserController.java updatePwd algorithmic complexity
https://notcve.org/view.php?id=CVE-2023-2473
A vulnerability was found in Dreamer CMS up to 4.1.3. It has been declared as problematic. This vulnerability affects the function updatePwd of the file UserController.java of the component Password Hash Calculation. The manipulation leads to inefficient algorithmic complexity. The attack can be initiated remotely. • https://gitee.com/isoftforce/dreamer_cms/issues/I6WHO7 https://vuldb.com/?ctiid.227860 https://vuldb.com/?id.227860 • CWE-407: Inefficient Algorithmic Complexity •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 1CVE-2023-30868 – WordPress CMS Tree Page View Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-30868
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jon Christopher CMS Tree Page View plugin <= 1.6.7 versions. The CMS Tree Page View plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_type' parameter in versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Note that this was partially patched in version 1.6.7 but some bypasses were possible until 1.6.8. • https://www.exploit-db.com/exploits/51507 http://packetstormsecurity.com/files/172730/WordPress-Tree-Page-View-1.6.7-Cross-Site-Scripting.html https://patchstack.com/database/vulnerability/cms-tree-page-view/wordpress-cms-tree-page-view-plugin-1-6-7-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-1746 – Dreamer CMS File Upload cross site scripting
https://notcve.org/view.php?id=CVE-2023-1746
A vulnerability, which was classified as problematic, was found in Dreamer CMS up to 3.5.0. Affected is an unknown function of the component File Upload Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-224634 is the identifier assigned to this vulnerability. • https://github.com/iteachyou-wjn/dreamer_cms/issues/11 https://vuldb.com/?ctiid.224634 https://vuldb.com/?id.224634 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-1484 – xzjie cms upload unrestricted upload
https://notcve.org/view.php?id=CVE-2023-1484
A vulnerability was found in xzjie cms up to 1.0.3 and classified as critical. This issue affects some unknown processing of the file /api/upload. The manipulation of the argument uploadFile leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-223367. • https://gitee.com/xzjie/cms/issues/I6INIT https://vuldb.com/?ctiid.223367 https://vuldb.com/?id.223367 • CWE-434: Unrestricted Upload of File with Dangerous Type •