Light0011
Monthly
Business logic errors in the light0011 CMS Vote Handler (App/Home/Controller/VoteController.class.php) let unauthenticated remote attackers craft HTTP requests with a manipulated, forged, or omitted X-Requested-With header to defeat the application's AJAX-request detection and drive the voting workflow into unintended states. Because the CVSS vector is PR:N/UI:N/AC:L, no credentials, no user interaction, and no non-default configuration are needed against a reachable deployment; impact is limited to low integrity and availability effects on vote handling (VC:N), with no confidentiality loss. Publicly available exploit code exists and the flaw is documented in the project's GitHub issue tracker (issue #16, VulDB 421676), but there is no confirmed active exploitation (not CISA KEV), and the vendor has not responded to the report or shipped a fix.
Unauthenticated file and directory existence disclosure in light0011 CMS (commits c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930) allows remote attackers to probe the filesystem through the Uploadify check-exists.php endpoint by controlling the filename argument. Publicly available exploit code exists, and the vendor has not responded to the issue report; CISA KEV does not list this CVE. Despite a CVSS 4.0 score of 6.9, our assessment scores it 5.3 because the flaw only reveals existence metadata-no file contents, write access, or availability impact.
light0011 CMS hashes user passwords with SHA-1 in App/Home/Model/UserModel.class.php, providing insufficient computational effort and allowing faster offline cracking if stored credential hashes are obtained. Public exploit code exists, but exploitation is difficult and requires prior read access to the user store, typically through a separate weakness such as SQL injection, backup exposure, or database compromise. With confidentiality-only impact, a niche unmaintained codebase, and no confirmed active exploitation, this is a low-real-world-priority issue despite the moderate 6.3 CVSS score.
Improper access control in light0011 CMS allows unauthenticated remote attackers to bypass Captcha Validation enforced in App/Home/Controller/UserController.class.php, enabling limited unauthorized user-related actions. The project has not responded to the reported issue and no vendor-released patch has been identified, while publicly available exploit code exists; CISA KEV does not list this CVE. The assessed impact is limited integrity impact rather than confidentiality or availability compromise.
Information disclosure in light0011 CMS exposes database debug output to unauthenticated remote attackers by manipulating the DB_DEBUG argument processed by the Debug Mode component in App/Common/Conf/config.php. The flaw allows network-accessible attackers to retrieve database diagnostic data - potentially including SQL query traces, schema details, or connection metadata - with no authentication and no user interaction required. A public proof-of-concept exploit exists via GitHub issue #17, and the vendor has not yet responded to the coordinated disclosure report, leaving all deployed instances unpatched.
Cross-site request forgery in light0011 cms (rolling-release, at minimum through commits c774dce3 and f72cf46f) allows a remote attacker to perform unauthorized state-changing operations on behalf of an authenticated CMS user by inducing that user to visit a malicious page. A public proof-of-concept is documented in GitHub issue #12, and the project maintainer has not responded to the disclosure, leaving the vulnerability unpatched. The CVSS 4.0 score of 5.3 reflects the moderate but real-world risk: low integrity impact, no confidentiality exposure, and a mandatory passive user-interaction requirement.
Unrestricted file upload in light0011 CMS allows unauthenticated remote attackers to upload arbitrary file types - including PHP webshells - via the Upload::upload function in the ThinkPHP-based CMS. The affected code is confirmed at commits c774dce and f72cf46 in the light0011/cms GitHub repository. A public proof-of-concept exploit has been released via a GitHub issue report; the vendor has not responded and no patched version exists.
Cross-site scripting in light0011 CMS allows remote attackers to inject arbitrary JavaScript into chapter content pages by manipulating the `content` argument processed through PHP's `htmlspecialchars_decode()` function in the chapter template. The misuse of this function-which decodes HTML entities rather than encoding them-means user-supplied chapter content is rendered as raw HTML in victims' browsers. A public proof-of-concept is available via GitHub issue #8, and the project maintainer has not responded to the coordinated disclosure.
Authorization bypass in the light0011 CMS Chapter Controller (ChapterController.class.php) exposes chapter content to unauthenticated remote attackers through insecure direct object reference (IDOR). By manipulating the `content` argument in HTTP requests, an attacker can reference chapter objects they are not permitted to access, circumventing the controller's access control entirely. A public exploit was disclosed via GitHub issue #5; the maintainer has not yet responded to the responsible disclosure report.
Server-side request forgery in light0011 CMS allows unauthenticated remote attackers to force the server to fetch arbitrary URLs by manipulating the `source[]` parameter in the bundled UEditor `catchimage` function at `Public/ueditor/php/controller.php`. Successful exploitation enables internal network reconnaissance, access to cloud metadata services (e.g., AWS IMDSv1), and pivoting to other HTTP endpoints not exposed externally. A public exploit exists via GitHub issue #6; the maintainer has not responded to disclosure and no patch has been released.
SQL injection in light0011 CMS exposes all deployments to unauthenticated remote database compromise through the ChapterModel::searchChapter function, where the `content` argument is passed unsanitized to the Query Builder in App/Home/Controller/ChapterController.class.php. Because the project uses no versioning, every deployed commit of this PHP CMS is affected with no vendor-patched baseline to target. A public proof-of-concept exploit is available via GitHub issue #7, and the project maintainer has not responded to disclosure, leaving no official remediation path.
Business logic errors in the light0011 CMS Vote Handler (App/Home/Controller/VoteController.class.php) let unauthenticated remote attackers craft HTTP requests with a manipulated, forged, or omitted X-Requested-With header to defeat the application's AJAX-request detection and drive the voting workflow into unintended states. Because the CVSS vector is PR:N/UI:N/AC:L, no credentials, no user interaction, and no non-default configuration are needed against a reachable deployment; impact is limited to low integrity and availability effects on vote handling (VC:N), with no confidentiality loss. Publicly available exploit code exists and the flaw is documented in the project's GitHub issue tracker (issue #16, VulDB 421676), but there is no confirmed active exploitation (not CISA KEV), and the vendor has not responded to the report or shipped a fix.
Unauthenticated file and directory existence disclosure in light0011 CMS (commits c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930) allows remote attackers to probe the filesystem through the Uploadify check-exists.php endpoint by controlling the filename argument. Publicly available exploit code exists, and the vendor has not responded to the issue report; CISA KEV does not list this CVE. Despite a CVSS 4.0 score of 6.9, our assessment scores it 5.3 because the flaw only reveals existence metadata-no file contents, write access, or availability impact.
light0011 CMS hashes user passwords with SHA-1 in App/Home/Model/UserModel.class.php, providing insufficient computational effort and allowing faster offline cracking if stored credential hashes are obtained. Public exploit code exists, but exploitation is difficult and requires prior read access to the user store, typically through a separate weakness such as SQL injection, backup exposure, or database compromise. With confidentiality-only impact, a niche unmaintained codebase, and no confirmed active exploitation, this is a low-real-world-priority issue despite the moderate 6.3 CVSS score.
Improper access control in light0011 CMS allows unauthenticated remote attackers to bypass Captcha Validation enforced in App/Home/Controller/UserController.class.php, enabling limited unauthorized user-related actions. The project has not responded to the reported issue and no vendor-released patch has been identified, while publicly available exploit code exists; CISA KEV does not list this CVE. The assessed impact is limited integrity impact rather than confidentiality or availability compromise.
Information disclosure in light0011 CMS exposes database debug output to unauthenticated remote attackers by manipulating the DB_DEBUG argument processed by the Debug Mode component in App/Common/Conf/config.php. The flaw allows network-accessible attackers to retrieve database diagnostic data - potentially including SQL query traces, schema details, or connection metadata - with no authentication and no user interaction required. A public proof-of-concept exploit exists via GitHub issue #17, and the vendor has not yet responded to the coordinated disclosure report, leaving all deployed instances unpatched.
Cross-site request forgery in light0011 cms (rolling-release, at minimum through commits c774dce3 and f72cf46f) allows a remote attacker to perform unauthorized state-changing operations on behalf of an authenticated CMS user by inducing that user to visit a malicious page. A public proof-of-concept is documented in GitHub issue #12, and the project maintainer has not responded to the disclosure, leaving the vulnerability unpatched. The CVSS 4.0 score of 5.3 reflects the moderate but real-world risk: low integrity impact, no confidentiality exposure, and a mandatory passive user-interaction requirement.
Unrestricted file upload in light0011 CMS allows unauthenticated remote attackers to upload arbitrary file types - including PHP webshells - via the Upload::upload function in the ThinkPHP-based CMS. The affected code is confirmed at commits c774dce and f72cf46 in the light0011/cms GitHub repository. A public proof-of-concept exploit has been released via a GitHub issue report; the vendor has not responded and no patched version exists.
Cross-site scripting in light0011 CMS allows remote attackers to inject arbitrary JavaScript into chapter content pages by manipulating the `content` argument processed through PHP's `htmlspecialchars_decode()` function in the chapter template. The misuse of this function-which decodes HTML entities rather than encoding them-means user-supplied chapter content is rendered as raw HTML in victims' browsers. A public proof-of-concept is available via GitHub issue #8, and the project maintainer has not responded to the coordinated disclosure.
Authorization bypass in the light0011 CMS Chapter Controller (ChapterController.class.php) exposes chapter content to unauthenticated remote attackers through insecure direct object reference (IDOR). By manipulating the `content` argument in HTTP requests, an attacker can reference chapter objects they are not permitted to access, circumventing the controller's access control entirely. A public exploit was disclosed via GitHub issue #5; the maintainer has not yet responded to the responsible disclosure report.
Server-side request forgery in light0011 CMS allows unauthenticated remote attackers to force the server to fetch arbitrary URLs by manipulating the `source[]` parameter in the bundled UEditor `catchimage` function at `Public/ueditor/php/controller.php`. Successful exploitation enables internal network reconnaissance, access to cloud metadata services (e.g., AWS IMDSv1), and pivoting to other HTTP endpoints not exposed externally. A public exploit exists via GitHub issue #6; the maintainer has not responded to disclosure and no patch has been released.
SQL injection in light0011 CMS exposes all deployments to unauthenticated remote database compromise through the ChapterModel::searchChapter function, where the `content` argument is passed unsanitized to the Query Builder in App/Home/Controller/ChapterController.class.php. Because the project uses no versioning, every deployed commit of this PHP CMS is affected with no vendor-patched baseline to target. A public proof-of-concept exploit is available via GitHub issue #7, and the project maintainer has not responded to disclosure, leaving no official remediation path.