2 results (0.003 seconds)

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 6

CVE-2015-1603

https://notcve.org/view.php?id=CVE-2015-1603

19 Feb 2015 — Multiple cross-site scripting (XSS) vulnerabilities in Adminsystems CMS before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter to index.php or (2) id parameter in a users_users action to asys/site/system.php. Múltiples vulnerabilidades de XSS en Adminsystems CMS anterior a 4.0.2 permiten a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través (1) del parámetro page en index.php o (2) del parámetro id en una acción users_users en asys... • http://packetstormsecurity.com/files/130394/Landsknecht-Adminsystems-CMS-4.0.1-CSRF-XSS-File-Upload.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 4%CPEs: 1EXPL: 6

CVE-2015-1604

https://notcve.org/view.php?id=CVE-2015-1604

19 Feb 2015 — Unrestricted file upload vulnerability in asys/site/files.php in Adminsystems CMS before 4.0.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in upload/files/. Vulnerabilidad de la subida de ficheros sin restricciones en asys/site/files.php en Adminsystems CMS anterior a 4.0.2 permite a usuarios remotos autenticados ejecutar código arbitrario mediante la subida de un fichero con una extensión ej... • http://packetstormsecurity.com/files/130394/Landsknecht-Adminsystems-CMS-4.0.1-CSRF-XSS-File-Upload.html • CWE-20: Improper Input Validation •