Cms

Race condition in Azuriom CMS up to v1.2.12 allows authenticated users to exploit a time-of-check time-of-use (TOCTOU) flaw in the money transfer handler, potentially duplicating in-game currency by submitting concurrent transfer requests that each pass the balance check before any deduction is applied. The commit diff confirms the vulnerability in ProfileController.php::transferMoney(), where a balance check was performed outside any database transaction lock. No public exploit identified at time of analysis, though the CVSS 4.0 supplemental metric E:P indicates proof-of-concept code exists. Attack complexity is rated high due to the narrow timing window required to win the race.

Stored XSS in Craft CMS's control panel allows a low-privilege author to execute arbitrary JavaScript in an administrator's authenticated session by injecting a malicious payload into a draft name, which is rendered without HTML encoding in element chips and cards. All Craft CMS installations running versions 5.0.0-RC1 through 5.10.8 (exclusive) are affected. An attacker who can create element drafts can harvest the administrator's CSRF token and issue privileged control-panel actions - including creating new administrator accounts - without the victim taking any action beyond routine browsing of element indexes or relation fields. No public exploit identified at time of analysis, though the vendor's GHSA advisory verified the account-creation impact end-to-end.

Improper authorization in Craft CMS 5.0.0-RC1 through 5.10.7 exposes the generic `elements/save` action to silent password manipulation, enabling any authenticated control panel user to reset their own password without confirming their current credentials. More critically, attackers holding the `edit users` permission can silently overwrite passwords for any account on the platform-including administrator accounts-achieving full administrative takeover without requiring the legitimately guarded `Administrate users` privilege. A vendor-released patch exists in version 5.10.8, and no public exploit code is identified at time of analysis, though the GHSA advisory's detailed technical description materially lowers the bar for independent exploitation.

Broken access control in Craft CMS 5.0.0-RC1 through 5.10.5 lets a control-panel user holding only the viewCategories permission permanently reorder and re-parent categories through the structures/move-element action, despite lacking saveCategories. Because category URIs are derived from structure position, an attacker can silently change category URLs and those of all descendants and corrupt taxonomy-driven navigation menus. Reported by VulnCheck with no public exploit identified at time of analysis; the flaw is an integrity-only bypass fixed in 5.10.6.

Server-side request forgery in Craft CMS's GraphQL API exposes internal networks and cloud metadata endpoints to attackers holding asset-creation-scoped tokens. The `save<Volume>Asset` GraphQL mutation fetches caller-supplied URLs server-side, and the `validateIp()` guard omits CGNAT (100.64.0.0/10) and NAT64 (64:ff9b::/96) ranges while also executing after the HTTP request has already been dispatched - meaning the check cannot prevent the unauthorized outbound connection. Affected are all 5.x installations from 5.0.0-RC1 through 5.10.5 and all 4.x installations from 4.0.0-RC1 through 4.18.1; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Path traversal weakness in Craft CMS's Local volume file system class exposes servers running versions 5.0.0-RC1 through 5.10.5 or 4.0.0-RC1 through 4.18.1 to a theoretical desanitization-style flaw in the `ensurePathIsContained` function. The validate-before-normalize ordering allows a crafted path to pass validation in its raw form yet resolve outside the intended volume directory after normalization, potentially enabling reads of files beyond the designated asset directory. The vendor explicitly confirms no exploitable scenario has been discovered and classifies this as a hardening fix; no public exploit exists and this CVE does not appear in the CISA KEV catalog.

Craft CMS exposes arbitrary environment variables and secrets to authenticated control panel users due to premature interpolation of ${ENV_VAR} patterns in the elementId parameter before Twig sandbox evaluation - a design flaw that bypasses the sandbox entirely because substitution occurs outside the renderer. Affected versions span both the 4.x and 5.x release lines from their respective RC1 milestones through just before 4.18.2 and 5.10.6. An attacker holding any control panel account can exfiltrate CRAFT_SECURITY_KEY and all other configured secrets via a blind, error-based extraction loop, enabling session forgery, privilege escalation, and theft of database, SMTP, API, and blob storage credentials; no public exploit or active exploitation has been identified at time of analysis.

Remote code execution in Craft CMS allows an authenticated control panel user to escape the Twig sandbox and execute arbitrary server-side PHP, even when sandbox mode is explicitly enabled via `enableTwigSandbox()`. The root cause is that the sandbox's class allowlisting propagates through the entire class hierarchy of `ElementInterface`, ultimately exposing the well-known `yii\base\Component` arbitrary function-call gadget - the identical primitive behind at least four prior Craft CMS CVEs. Affected versions are 5.0.0-RC1 through 5.10.6 and 4.0.0-RC1 through 4.18.2; patched releases 5.10.7 and 4.18.3 are available, and no CISA KEV listing exists at time of analysis.

Passkey authentication in Craft CMS before 5.10.5 is vulnerable to WebAuthn assertion replay, enabling an attacker who obtains a captured login request body to create additional authenticated sessions for a victim account without possessing the passkey device. The root cause is a dual failure at the `users/login-with-passkey` endpoint: the server accepts client-supplied `PublicKeyCredentialRequestOptions` - bypassing server-generated challenge binding - and never persists the updated credential counter after assertion validation, leaving it permanently stale. No public exploit code has been identified at time of analysis, though the GHSA advisory documents a complete step-by-step attack scenario; organizations with passkey authentication enabled in Craft CMS 5.x should treat the vendor-released patch (5.10.5) as urgent.

Arbitrary file read in Craft CMS 4.x and 5.x exposes .env files, database credentials, and security keys by exploiting an incomplete blocklist in the create() Twig function that omits PHP's SplFileObject class. An authenticated administrator with allowAdminChanges=true can plant a malicious entry type title or URI format; when any user subsequently creates an entry in the affected section, the Twig renderer instantiates SplFileObject and renders the contents of arbitrary server files as entry titles. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the GitHub Security Advisory GHSA-957r-qf9p-67xw provides full technical disclosure of the technique.

Authenticated remote code execution in Craft CMS control panels allows any user with a valid panel session to execute operating system commands as the PHP/web user by exploiting a config-cleanse bypass in element-search condition handling. Affected versions span the 4.x branch from 4.0.0-RC1 through 4.18.1, and the 5.x branch from 5.0.0-RC1 through 5.10.5. The GHSA advisory confirms lab-verified exploitation; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

SQL injection in Loca Software Informatics Technology Ltd. Co. CMS (all versions up to and including build 06082026) allows remote unauthenticated attackers to inject arbitrary SQL through improperly neutralized input, per CVSS PR:N. Disclosed by Turkey's national CERT (TR-CERT/USOM), the flaw carries a critical 9.8 score with full confidentiality, integrity, and availability impact, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor was contacted but did not respond, so no fix is available.

Statamic CMS exposes authenticated users' raw two-factor authentication recovery codes through the Antlers templating engine due to a missing access restriction in the `AugmentedUser::get()` resolver. Unlike `password` and `password_hash` fields, which are explicitly excluded from augmentation, `two_factor_recovery_codes` is returned without restriction and is absent from all Antlers variable guard lists. An administrator or developer who has configured a blueprint field with dynamic Antlers rendering enabled can craft a template (`{{ current_user.two_factor_recovery_codes }}`) that, when rendered by a victim visiting the page, leaks that victim's 2FA recovery codes into the HTML response - enabling 2FA bypass. No public exploit has been identified at time of analysis, and exploitation requires a high-privilege prerequisite (blueprint configuration access).

Path traversal in Croogo CMS up to version 4.0.7 allows remote authenticated attackers to escape the intended file management directory by supplying crafted path sequences to the Admin File Manager's FileManager::isEditable function in FileManager/src/Utility/FileManager.php. A public proof-of-concept exploit exists and has been disclosed via a researcher advisory, while the Croogo project has not responded to the responsible disclosure report and no patch has been released. The vulnerability carries a medium base score but the combination of a public PoC, unresponsive vendor, and no remediation path meaningfully elevates practical risk for any internet-exposed Croogo instance.

Stored cross-site scripting in Pluck CMS 4.7.21 and earlier allows an authenticated administrator to inject persistent malicious scripts via the Info argument of the Albums module, which subsequently execute in the browsers of users who view the affected content. The flaw originates from misuse of htmlspecialchars_decode in albums.admin.php, which reverses HTML entity encoding on attacker-controlled input rather than sanitizing it, allowing script payloads to survive into rendered HTML. A public proof-of-concept exploit exists on GitHub and no vendor patch has been released; the maintainer has not responded to the disclosure.

Remote code execution in Mura CMS versions prior to 10.0.712 allows unauthenticated attackers to execute arbitrary CFML and instantiate malicious Java objects by abusing the unvalidated 'method' parameter in POST requests to the /index.cfm/_api/json/v1/default JSON API endpoint. Because the ColdFusion engine processes the attacker-controlled input without sanitisation, a single crafted request yields full compromise (VC:H/VI:H/VA:H). No public exploit identified at time of analysis, though CISA SSVC flags the flaw as automatable with total technical impact.

Improper authorization in Craft CMS up to 4.18.0.1 allows authenticated low-privileged users to access new user statistics for arbitrary user groups via the Charts endpoint. The flaw resides in the `actionGetNewUsersData` function within `src/controllers/ChartsController.php`, where the `userGroupId` parameter is not properly validated against the requesting user's authorization scope, enabling horizontal privilege escalation to read data across user group boundaries. No public exploit has been identified at time of analysis, but a vendor-released patch is available in version 4.18.1.

Authorization bypass in Craft CMS up to 4.18.0.1 allows authenticated low-privilege users to invoke the reorder-sets endpoint and manipulate Global Set ordering outside their authorized scope. The flaw resides in the actionReorderSets function of GlobalsController.php and is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), an IDOR-class root cause where resource-level permission checks are absent. No public exploit has been identified at time of analysis and no CISA KEV listing exists; a vendor-released patch is available in version 4.18.1.

Craft CMS versions 4.x prior to 4.17.14 and 5.x prior to 5.9.21 contain a missing authorization check (CWE-862) in the asset folder move operation that allows an authenticated user to delete a destination folder they lack delete permission on by exploiting the force=true overwrite path in AssetsController::actionMoveFolder(). The CVSS 4.0 score of 4.9 with PR:L and VI:H reflects a real but internally-scoped integrity impact: an attacker with move-but-not-delete rights can destroy asset content outside their permission boundary. No public exploit code exists and no active exploitation has been identified; the E:U supplemental metric in the provided vector corroborates this assessment.

Cross-tenant entry takeover in Craft CMS 5.7.0 through 5.9.20 lets a low-privileged author overwrite another user's existing entry by smuggling a numeric id through the newAttributes parameter of the bulk-duplicate element action. Because the duplication routine re-applies attacker-controlled attributes after nulling the primary key, a UPDATE is executed against the victim's row instead of an INSERT, letting the attacker rewrite the victim's title, slug, authorId, postDate, and UID. No public exploit identified at time of analysis and it is not in CISA KEV; the flaw is fixed in version 5.9.21.

Broken authorization in Craft CMS lets a low-privilege authenticated user destroy other users' assets on a shared volume. AssetsController::actionDeleteFolder() checks only the deleteAssets:<volume-uid> permission for the target folder but never enforces deletePeerAssets:<volume-uid>, while the underlying Assets::deleteFoldersByIds() cascades deletion to every descendant folder and asset regardless of who uploaded them. No public exploit is identified at time of analysis and it is not listed in CISA KEV; the vendor patched it in 4.17.15 and 5.9.22.

Unauthorized cross-volume asset deletion in Craft CMS versions 4.0.0-RC1 through 4.17.13 and 5.0.0-RC1 through 5.9.20 allows any authenticated user with file-replace permission in one volume to permanently delete assets from other volumes where they hold no delete permission. The flaw stems from a PHP ternary operator short-circuit in AssetsController::actionReplaceFile() that bypasses source-volume authorization when both assetId and sourceAssetId parameters are supplied together. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the low complexity of the attack logic and the CMS's sequential asset IDs make exploitation straightforward for any low-privilege authenticated insider or compromised account.

Unauthenticated access to the /api/articles REST API endpoint in Feehi CMS up to version 2.1.1 exposes article management functions without any credential verification, allowing remote attackers to interact with CMS content at low complexity and zero privilege. A publicly available proof-of-concept exploit exists via a GitHub issue report. The vendor has not responded to the disclosure, leaving installations without an official patch; no KEV listing indicates no confirmed mass exploitation at time of analysis, but the no-authentication network vector makes this trivially accessible to any internet-facing attacker.

Improper access control in Feehi CMS up to version 2.1.1 allows low-privileged remote attackers to perform unauthorized operations against the /api/users API endpoint. Exploitation of CWE-284 at this endpoint enables access to or manipulation of user data beyond what the authenticated role should permit, representing an authentication bypass at the authorization layer. A public exploit exists per GitHub issue #89; no vendor patch or response has been issued as of analysis time, leaving the exposure unmitigated.

Authenticated path traversal in Craft CMS (4.0.0-RC1 through 4.17.6 and 5.0.0-RC1 through 5.9.12) allows low-privileged users to read arbitrary SVG files on the server via the assets/icon endpoint's extension parameter, which was passed to file existence checks without validation. No public exploit identified at time of analysis, though VulnCheck published an advisory and the upstream fix is visible in commit 30f5f1a. Confidentiality impact is high but no integrity or availability impact, and exploitation requires valid authenticated session.

Stored XSS in Craft CMS 4.x and 5.x allows an authenticated administrator to persist malicious JavaScript payloads in settings fields - section names, volume names, user group names, global set names, generated field names, checkbox/radio option labels, and custom source labels - that execute in other users' control-panel browser sessions when those pages are visited. The attack surface spans seven distinct injection points across the admin settings UI, all sharing the same root defect in Twig template rendering. No public exploit identified at time of analysis, though a proof of concept is documented in the upstream security advisory GHSA-4mgv-366x-qxvx, and the upstream CHANGELOG characterizes the severity as low.

Authorization bypass in Craft CMS's `assets/preview-file` endpoint exposes private asset preview content to authenticated low-privileged users who lack view permission on the targeted asset. Affected installations running Craft CMS 4.0.0-RC1 through 4.17.7 or 5.0.0-RC1 through 5.9.13 with mixed-privilege users and private assets are vulnerable to unauthorized disclosure of preview HTML and private asset image routes. No public exploit or CISA KEV listing has been identified; patches are available in versions 4.17.8 and 5.9.14.

Missing authorization in the Craft CMS `assets/preview-thumb` Control Panel endpoint allows any authenticated low-privilege CP user to obtain signed transform preview URLs for private assets they are not permitted to view, by supplying an attacker-controlled `assetId`. Affected installations span the 4.x branch (4.0.0-RC1 through 4.17.7) and 5.x branch (5.0.0-RC1 through 5.9.13); patches are available in 4.17.8 and 5.9.14. No public exploit or active exploitation has been identified at time of analysis.

Stored XSS in Craft CMS's Table field component allows an authenticated administrator to persist arbitrary JavaScript via the Row Heading column type's default values, executing in the browser of any subsequent user who views a page rendering the affected table field. Affected deployments span Craft CMS 4.5.0-beta.1 through 4.16.18 and 5.0.0-RC1 through 5.8.22; patches are available in 4.16.19 and 5.8.23. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the GHSA advisory published a working proof-of-concept payload, and real-world risk is substantially constrained by the non-default allowAdminChanges production setting.

Authenticated remote code execution in Craft CMS versions 5.5.0 through 5.9.13 allows admin users to execute arbitrary PHP by injecting Yii2 event handlers via the fieldLayoutConfig POST parameter to FieldsController::actionRenderCardPreview(). The flaw stems from missing Component::cleanseConfig() sanitization, enabling disclosure of environment variables including database credentials and CRAFT_SECURITY_KEY. No public exploit identified at time of analysis, though VulnCheck has published a detailed advisory describing the attack technique.

Stored XSS in Craft CMS (versions 5.0.0-RC1 through 5.8.21) allows an admin-level attacker to permanently embed malicious JavaScript into the User Permissions page by crafting a user group name with an unsanitized HTML payload. The script executes in the browser of any user who subsequently opens the Permissions tab on a user's edit page, creating a persistent cross-user attack vector within the control panel. Vendor-confirmed proof-of-concept steps are publicly documented in GHSA-g3hp-vvqf-8vw6; no confirmed active exploitation or CISA KEV listing at time of analysis.

Unauthorized resource disclosure in Statamic CMS allows any authenticated Control Panel user to read metadata and content for entries, assets, users, roles, and groups beyond their assigned permissions. All v5 releases prior to 5.73.23 and all v6 releases prior to 6.20.0 are affected. Exploitation is read-only - no data can be modified - and no public exploit has been identified at time of analysis, but the flaw is significant for multi-tenant deployments relying on Statamic's role-based access controls to segregate content.

Integrity and availability loss in Statamic CMS versions prior to 5.73.23 and 6.20.0 allows remote attackers to destroy content and assets by manipulating sort parameters that flow into in-memory collection sorting. This is an incomplete-fix follow-up to CVE-2026-41175 (CWE-470, unsafe reflection / method invocation), where the original patch covered the query builder but not the in-memory sort path. No public exploit identified at time of analysis and not in CISA KEV; exploitation requires a non-default template configuration that pipes visitor input into a tag's sort parameter.

HTML injection in Bolt CMS 3.7.5 and earlier allows authenticated remote attackers to inject arbitrary HTML by manipulating the `style` argument within the HTML Attribute Handler component (`src/Storage/Field/Type/TextType.php`). The vulnerability requires low-privilege credentials and passive victim interaction for injected content to render, producing low-severity but persistent integrity exposure. Publicly available exploit code exists (CVSS E:P confirmed), and because the project repository has been archived as read-only by the maintainer, no vendor patch will ever be released - any remaining deployment faces permanent unpatched exposure.

Cross-site scripting (XSS) in MaxSite CMS up to version 109.3 allows authenticated high-privilege users to inject malicious scripts via the ushki Plugin's f_ushka_new or f_ushk parameters. The vulnerability requires user interaction to trigger, but publicly available exploit code exists. Vendor classified this as self-XSS and fixed the root cause (missing htmlspecialchars() filtering) in version 109.4.

Cross-site scripting (XSS) in MaxSite CMS Guestbook Plugin up to version 109.3 allows authenticated high-privilege users to inject malicious scripts via the f_text, f_slug, f_limit, or f_email parameters due to missing htmlspecialchars() output filtering. The vulnerability requires high-privilege authentication and user interaction (UI:P), limiting it to trusted administrators, but publicly available exploit code exists. Upgrading to version 109.4 resolves the issue by implementing proper output encoding.

Cross-site scripting (XSS) in MaxSite CMS up to version 109.3 affects the down_count plugin, where unsanitized input in the f_file and f_prefix parameters allows authenticated high-privilege users to inject malicious scripts via remote network access with user interaction. The vendor classifies this as self-XSS due to high privilege requirements (PR:H) and user interaction (UI:P), but the lack of output encoding via htmlspecialchars() represents a secure coding violation. Publicly available exploit code exists, and a patch is available in version 109.4.

Cross-site scripting (XSS) in MaxSite CMS mail_send plugin up to version 109.3 allows authenticated high-privilege users to inject malicious scripts via the f_subject, f_files, or f_from parameters, resulting in stored XSS that can affect other users. The vulnerability stems from missing input sanitization via htmlspecialchars() and is classified by the vendor as self-XSS. Publicly available exploit code exists, and a patch is available in version 109.4.

Cross-site scripting vulnerability in MaxSite CMS Redirect Plugin up to version 109.3 allows authenticated high-privilege users to inject malicious scripts via the f_all or f_all404 parameters due to missing output encoding with htmlspecialchars(). The vulnerability requires high-privilege authentication and user interaction to execute, resulting in low impact (integrity only); however, publicly available exploit code exists and the vendor has classified this as a self-XSS violation of secure coding standards. Upgrade to version 109.4 or later to remediate.

Cross-site scripting (XSS) in MaxSite CMS up to version 109.3 allows authenticated administrators to inject malicious scripts via the f_logging_file parameter in the Antispam Plugin admin interface, leading to stored XSS with user interaction required. The vulnerability affects the /admin/plugin_antispam endpoint and results from insufficient output encoding. Vendor-released patch version 109.4 addresses the issue by implementing htmlspecialchars() filtering; publicly available exploit code exists.

Mass deletion of content, assets, and user accounts in Statamic CMS versions prior to 5.73.20 and 6.13.0 occurs via query parameter manipulation on Control Panel endpoints (requiring minimal authentication like 'view entries' permission) or unauthenticated exploitation through REST/GraphQL APIs if explicitly enabled without authentication. Authenticated attackers with low-privilege viewer roles can escalate to delete resources they should only read. Unauthenticated attackers can exploit misconfigured API endpoints (non-default configuration) to achieve the same destructive impact. CVSS 8.1 (High) reflects network-accessible attack with low complexity, though exploitation conditions vary significantly by deployment configuration. No active exploitation confirmed (not in CISA KEV), EPSS data not provided.

Server-side request forgery in Qibo CMS 1.0 allows authenticated remote attackers to manipulate the 'starts' parameter in /index/image/headers endpoint, triggering arbitrary internal requests from the server. Publicly available exploit code exists. The vendor did not respond to early disclosure notification, leaving no patched version available.

Cross-site scripting (XSS) in Qibo CMS 1.0 Internal Message Module allows authenticated remote attackers to inject malicious scripts through message manipulation, affecting user sessions and data integrity. The vulnerability requires user interaction (UI:P) and valid authentication (PR:L), limiting exposure to authenticated users. Public exploit code is available, though the vendor has not responded to disclosure attempts.

A security vulnerability in Craft CMS (CVSS 9.8). Critical severity with potential for significant impact on affected systems.

phpKF CMS 3.00 Beta allows unauthenticated PHP file upload by disguising it as a PNG, then renaming it for execution. PoC available.

A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.

A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.

A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.

A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.

A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.

A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.

A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.

A security vulnerability in juzaweb CMS (CVSS 4.3). Risk factors: public PoC available.

A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.

SQL injection vulnerability found in Enricozab CMS v.1.0 allows a remote attacker to execute arbitrary code via /hdo/hdo-view-case.php. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A vulnerability was found in juzaweb CMS up to 3.4.2. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

juzaweb <= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Cross Site Scripting vulnerability in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter of the registration page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Fuge CMS v1.0 contains an Open Redirect vulnerability in member/RegisterAct.java. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Fuge CMS v1.0 contains an Open Redirect vulnerability via /front/ProcessAct.java. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

admin/app/mediamanager in Schlix CMS 2.1.8-7 allows Authenticated Unrestricted File Upload, leading to remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Multiple cross-site scripting (XSS) vulnerabilities in Sitecore CMS 9.0.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) #300583 - List Manager Dashboard. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

In Sitecore 8.2, there is absolute path traversal via the shell/Applications/Layouts/IDE.aspx fi parameter and the admin/LinqScratchPad.aspx Reference parameter. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of administrators for requests that add a value to a profile field via a profilefields. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Cross-site scripting (XSS) vulnerability in Sitecore CMS before 7.0 Update-4 (rev. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) find or (2) replace fields to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 11.0%.

SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the postId parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary code by uploading a file with a .php;.gif extension, then. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Havalite CMS 1.1.0 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the configuration database via a direct. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Epss exploitation probability 35.4% and no vendor patch available.