CVE
Vendors
Products
Updated
CVSS v2
CVSS v3
A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file (.ftl filetype) that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a web page.
Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.
HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.
Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field.
Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field.
No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article "keyword" parameter.
No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article/index/ "article_title" parameter.
IBM Cloud App Management V2018.2.0, V2018.4.0, and V2018.4.1 could allow an attacker to obtain sensitive configuration information using a specially crafted HTTP request. IBM X-Force ID: 154283.
ThinkCMF X2.2.2 has SQL Injection via the method edit_post in ArticleController.class.php and is exploitable by normal authenticated users via the post[id][1] parameter in an article edit_post action.
ThinkCMF X2.2.2 has SQL Injection via the function _listorders() in AdminbaseController.class.php and is exploitable with the manager privilege via the listorders[key][1] parameter in a Link listorders action.