Filtered by vendor Cmseasy Subscriptions
Filtered by product Cmseasy Subscriptions
Total 13 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-11680 1 Cmseasy 1 Cmseasy 2024-09-17 N/A
An issue was discovered in CmsEasy 6.1_20180508. There is a CSRF vulnerability in the rich text editor that can add an IFRAME element. This might be used in a DoS attack if a referenced remote URL is refreshed at a rapid rate.
CVE-2019-8432 1 Cmseasy 1 Cmseasy 2024-09-17 N/A
In CmsEasy 7.0, there is XSS via the ckplayer.php url parameter.
CVE-2018-11679 1 Cmseasy 1 Cmseasy 2024-09-17 N/A
An issue was discovered in CmsEasy 6.1_20180508. There is a CSRF vulnerability that can add an article via /index.php?case=table&act=add&table=archive&admin_dir=admin.
CVE-2019-8434 1 Cmseasy 1 Cmseasy 2024-09-16 N/A
In CmsEasy 7.0, there is XSS via the ckplayer.php autoplay parameter.
CVE-2020-18406 1 Cmseasy 1 Cmseasy 2024-08-04 7.5 High
An issue was discovered in cmseasy v7.0.0 that allows user credentials to be sent in clear text due to no encryption of form data.
CVE-2021-42644 1 Cmseasy 1 Cmseasy 2024-08-04 6.5 Medium
cmseasy V7.7.5_20211012 is affected by an arbitrary file read vulnerability. After login, the configuration file information of the website such as the database configuration file (config / config_database) can be read through this vulnerability.
CVE-2021-42643 1 Cmseasy 1 Cmseasy 2024-08-04 8.8 High
cmseasy V7.7.5_20211012 is affected by an arbitrary file write vulnerability. Through this vulnerability, a PHP script file is written to the website server, and accessing this file can lead to a code execution vulnerability.
CVE-2023-34880 1 Cmseasy 1 Cmseasy 2024-08-02 9.8 Critical
cmseasy v7.7.7.7 20230520 was discovered to contain a path traversal vulnerability via the add_action method at lib/admin/language_admin.php. This vulnerability allows attackers to execute arbitrary code and perform a local file inclusion.
CVE-2024-32162 1 Cmseasy 1 Cmseasy 2024-08-02 4.3 Medium
CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion.
CVE-2024-32236 1 Cmseasy 1 Cmseasy 2024-08-02 3.5 Low
An issue in CmsEasy v.7.7 and before allows a remote attacker to obtain sensitive information via the update function in the index.php component.
CVE-2024-32163 1 Cmseasy 1 Cmseasy 2024-08-02 6.4 Medium
CMSeasy 7.7.7.9 is vulnerable to code execution.
CVE-2024-31551 1 Cmseasy 1 Cmseasy 2024-08-02 7.5 High
Directory Traversal vulnerability in lib/admin/image.admin.php in cmseasy v7.7.7.9 20240105 allows attackers to delete arbitrary files via crafted GET request.
CVE-2024-0523 1 Cmseasy 1 Cmseasy 2024-08-01 6.3 Medium
A vulnerability was found in CmsEasy up to 7.7.7. It has been declared as critical. Affected by this vulnerability is the function getslide_child_action in the library lib/admin/language_admin.php. The manipulation of the argument sid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250693 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.