CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12823
https://notcve.org/view.php?id=CVE-2019-12823
Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS. Craft CMS antes de la versión 3.1.31 no filtra correctamente los feeds XML y por lo tanto permite XSS • https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md https://github.com/craftcms/cms/commit/6432eca59b93bcea2ca2616199e5d419447e613f • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2019-9554 – Craft CMS 3.1.12 Pro - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2019-9554
In the 3.1.12 Pro version of Craft CMS, XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI. En la versión 3.1.12 Pro de Craft CMS, se descubrió una vulnerabilidad de tipo XSS en el campo de inserción del encabezado cuando se agrega el código fuente en un URI s/admin/entries/news/new. Craft CMS version 3.1.12 Pro suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/46496 https://packetstormsecurity.com/files/151944/Craft-CMS-3.1.12-Pro-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2018-20465
https://notcve.org/view.php?id=CVE-2018-20465
Craft CMS through 3.0.34 allows remote authenticated administrators to read sensitive information via server-side template injection, as demonstrated by a {% string for craft.app.config.DB.user and craft.app.config.DB.password in the URI Format of the Site Settings, which causes a cleartext username and password to be displayed in a URI field. Craft CMS, hasta la versión 3.0.34, permite que administradores autenticados remotos lean información sensible mediante una inyección de plantillas del lado del servidor, tal y como queda demostrado con una cadena {% para craft.app.config.DB.user y craft.app.config.DB.password en el formato de URI de las opciones del sitio, lo que provoca que se muestren el nombre de usuario y la contraseña en texto claro en un campo URI. • https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md https://github.com/phuctam/Server-Side-Template-Injection-in-CraftCMS-/issues/1 • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 3CVE-2018-20418 – Craft CMS 3.0.25 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-20418
index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab. index.php?p=admin/actions/entries/save-entry en Craft CMS 3.0.25 permite Cross-Site Scripting (XSS) mediante el guardado de un nuevo título de la pestaña de la consola. Craft CMS version 3.0.25 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/46054 https://github.com/craftcms/cms/blob/master/CHANGELOG-v3.md https://github.com/rdincel1/Craft-CMS-3.0.25---Cross-Site-Scripting https://www.raifberkaydincel.com/craft-cms-3-0-25-cross-site-scripting-vulnerability.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-3814
https://notcve.org/view.php?id=CVE-2018-3814
Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets->Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension. Craft CMS 2.6.3000 permite que los atacantes remotos ejecuten código PHP arbitrario utilizando la pantalla "Assets->Upload files" y luego la opción "Replace it", ya que esto permite que un archivo .jpg tenga código PHP incrustado y que luego se renombre a una extensión .php. • https://github.com/Snowty/myCVE/blob/master/CraftCMS-2.6.3000/README.md • CWE-434: Unrestricted Upload of File with Dangerous Type •