|
210251
|
6.1 |
MEDIUM
Network
|
5none
|
nonecms
|
NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parame…
|
CWE-352
Origin Validation Error
|
CVE-2020-23376
|
2024-11-21 14:13 |
2021-05-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210252
|
5.4 |
MEDIUM
Network
|
5none
|
nonecms
|
Cross-site scripting (XSS) vulnerability in admin/article/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter.
|
CWE-79
Cross-site Scripting
|
CVE-2020-23374
|
2024-11-21 14:13 |
2021-05-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210253
|
5.4 |
MEDIUM
Network
|
5none
|
nonecms
|
Cross-site scripting (XSS) vulnerability in admin/nav/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter.
|
CWE-79
Cross-site Scripting
|
CVE-2020-23373
|
2024-11-21 14:13 |
2021-05-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210254
|
6.1 |
MEDIUM
Network
|
5none
|
nonecms
|
Cross-site scripting (XSS) vulnerability in static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf in noneCms v1.3.0 allows remote attackers to inject arbitrary web script or HTML via the…
|
CWE-79
Cross-site Scripting
|
CVE-2020-23371
|
2024-11-21 14:13 |
2021-05-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210255
|
5.4 |
MEDIUM
Network
|
yzmcms
|
yzmcms
|
In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected wit…
|
CWE-79
Cross-site Scripting
|
CVE-2020-23370
|
2024-11-21 14:13 |
2021-05-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210256
|
6.1 |
MEDIUM
Network
|
yzmcms
|
yzmcms
|
In YzmCMS 5.6, XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3.
|
CWE-79
Cross-site Scripting
|
CVE-2020-23369
|
2024-11-21 14:13 |
2021-05-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210257
|
7.8 |
HIGH
Local
|
windscribe
|
windscribe
|
In Windscribe v1.83 Build 20, 'WindscribeService' has an Unquoted Service Path that facilitates privilege escalation.
|
CWE-428
Unquoted Search Path or Element
|
CVE-2020-22809
|
2024-11-21 14:13 |
2021-05-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210258
|
8.8 |
HIGH
Network
|
fork-cms
|
fork_cms
|
Cross-site request forgery (CSRF) in Fork-CMS before 5.8.2 allow remote attackers to hijack the authentication of logged administrators.
|
CWE-352
Origin Validation Error
|
CVE-2020-23264
|
2024-11-21 14:13 |
2021-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210259
|
6.1 |
MEDIUM
Network
|
fork-cms
|
fork_cms
|
Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the "navigation_title" parameter and the "title" parameter in /…
|
CWE-79
Cross-site Scripting
|
CVE-2020-23263
|
2024-11-21 14:13 |
2021-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
210260
|
4.9 |
MEDIUM
Network
|
chamilo
|
chamilo_lms
|
Chamilo LMS 1.11.10 does not properly manage privileges which could allow a user with Sessions administrator privilege to create a new user then use the edit user function to change this new user to …
|
CWE-269
Improper Privilege Management
|
CVE-2020-23128
|
2024-11-21 14:13 |
2021-05-6 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|