Show filters
102 Total Results
Displaying 51-60 of 102
Sort by:
Attacker Value
Unknown
CVE-2019-13971
Disclosure Date: July 19, 2019 (last updated November 27, 2024)
OTCMS 3.81 allows XSS via the mode parameter in an apiRun.php?mudi=autoRun request.
0
Attacker Value
Unknown
CVE-2019-12872
Disclosure Date: June 18, 2019 (last updated November 27, 2024)
dotCMS before 5.1.6 is vulnerable to a SQL injection that can be exploited by an attacker of the role Publisher via view_unpushed_bundles.jsp.
0
Attacker Value
Unknown
CVE-2019-12309
Disclosure Date: May 23, 2019 (last updated November 27, 2024)
dotCMS before 5.1.0 has a path traversal vulnerability exploitable by an administrator to create files. The vulnerability is caused by the insecure extraction of a ZIP archive.
0
Attacker Value
Unknown
CVE-2019-11846
Disclosure Date: May 14, 2019 (last updated November 27, 2024)
/servlets/ajax_file_upload?fieldName=binary3 in dotCMS 5.1.1 allows XSS and HTML Injection.
0
Attacker Value
Unknown
CVE-2018-17422
Disclosure Date: March 07, 2019 (last updated November 27, 2024)
dotCMS before 5.0.2 has open redirects via the html/common/forward_js.jsp FORWARD_URL parameter or the html/portlet/ext/common/page_preview_popup.jsp hostname parameter.
0
Attacker Value
Unknown
CVE-2019-8422
Disclosure Date: February 17, 2019 (last updated November 27, 2024)
A SQL Injection vulnerability exists in PbootCMS v1.3.2 via the description parameter in apps\admin\controller\content\ContentController.php.
0
Attacker Value
Unknown
CVE-2019-7570
Disclosure Date: February 07, 2019 (last updated November 27, 2024)
A CSRF vulnerability was found in PbootCMS v1.3.6 that can delete users via an admin.php/User/del/ucode/ URI.
0
Attacker Value
Unknown
CVE-2018-19893
Disclosure Date: December 06, 2018 (last updated November 27, 2024)
SearchController.php in PbootCMS 1.2.1 has SQL injection via the index.php/Search/index.html query string.
0
Attacker Value
Unknown
CVE-2018-19595
Disclosure Date: November 27, 2018 (last updated November 27, 2024)
PbootCMS V1.3.1 build 2018-11-14 allows remote attackers to execute arbitrary code via use of "eval" with mixed case, as demonstrated by an index.php/list/5/?current={pboot:if(evAl($_GET[a]))}1{/pboot:if}&a=phpinfo(); URI, because of an incorrect apps\home\controller\ParserController.php parserIfLabel protection mechanism.
0
Attacker Value
Unknown
CVE-2018-19554
Disclosure Date: November 26, 2018 (last updated November 08, 2023)
An issue was discovered in Dotcms through 5.0.3. Attackers may perform XSS attacks via the inode, identifier, or fieldName parameter in html/js/dotcms/dijit/image/image_tool.jsp.
0
