CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-50348 – InstantCMS has a Cross Site Scripting Vulnerability
https://notcve.org/view.php?id=CVE-2024-50348
InstantCMS is a free and open source content management system. In photo upload function in the photo album page there is no input validation taking place. Due to this attackers are able to inject the XSS (Cross Site Scripting) payload and execute. This vulnerability is fixed in 2.16.3. InstantCMS es un sistema de gestión de contenido gratuito y de código abierto. • https://github.com/instantsoft/icms2/commit/e02de2fa1850bb40c9b2050b9256c838a0ea7aa3 https://github.com/instantsoft/icms2/security/advisories/GHSA-f6cf-jg84-fw29 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31213 – InstantCMS Open Redirect vulnerability
https://notcve.org/view.php?id=CVE-2024-31213
InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after modifying one's own user profile. An attacker could trick a victim into visiting their web application, thinking they are still present on the ICMS2 application. They could then host a website stating "To update your profile, please enter your password," upon which the user may type their password and send it to the attacker. As of time of publication, a patched version is not available. • https://github.com/instantsoft/icms2/security/advisories/GHSA-6v3c-p92q-prfq • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2023-4928 – SQL Injection in instantsoft/icms2
https://notcve.org/view.php?id=CVE-2023-4928
SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1. Inyección SQL en el repositorio de GitHub instantsoft/icms2 anterior a 2.16.1. • https://github.com/instantsoft/icms2/commit/3a6b148fa2c943ee7647e0cd14bf68e026b15548 https://huntr.dev/bounties/cb72cc17-5a0d-4392-9a5f-a13aa773de9e • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •