Daicuo
Monthly
Cross-site request forgery vulnerability in DaiCuo CMS up to version 1.3.13 allows remote attackers to perform unintended actions on behalf of authenticated administrators by tricking them into clicking a malicious link while logged into the application. The exploit is publicly available, and affected installations may be manipulated via the /admin.php/addon/index endpoint. No active exploitation has been confirmed by CISA KEV, and EPSS score indicates low exploitation probability (0.08%).
A vulnerability was found in DaiCuo 1.3.13. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability in /admin.php of DaiCuo v2.5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site request forgery vulnerability in DaiCuo CMS up to version 1.3.13 allows remote attackers to perform unintended actions on behalf of authenticated administrators by tricking them into clicking a malicious link while logged into the application. The exploit is publicly available, and affected installations may be manipulated via the /admin.php/addon/index endpoint. No active exploitation has been confirmed by CISA KEV, and EPSS score indicates low exploitation probability (0.08%).
A vulnerability was found in DaiCuo 1.3.13. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A stored cross-site scripting (XSS) vulnerability in /admin.php of DaiCuo v2.5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.