Filtered by vendor Wcms
Subscribe
Search
Total
5 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-24136 | 1 Wcms | 1 Wcms | 2021-04-19 | 7.8 HIGH | 8.6 HIGH |
| Directory traversal in Wcms 0.3.2 allows an attacker to read arbitrary files on the server that is running an application via the pagename parameter to wex/html.php. | |||||
| CVE-2020-24139 | 1 Wcms | 1 Wcms | 2021-04-13 | 7.5 HIGH | 8.3 HIGH |
| Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application via the path parameter to wex/cssjs.php. It can help identify open ports, local network hosts and execute command on local services. | |||||
| CVE-2020-24140 | 1 Wcms | 1 Wcms | 2021-04-13 | 7.5 HIGH | 8.3 HIGH |
| Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via the pagename parameter to wex/html.php. It can help identify open ports, local network hosts and execute command on local services. | |||||
| CVE-2019-14240 | 1 Wcms | 1 Wcms | 2020-08-24 | 5.8 MEDIUM | 8.1 HIGH |
| WCMS v0.3.2 has a CSRF vulnerability, with resultant directory traversal, to modify index.html via the /wex/html.php?finish=../index.html URI. | |||||
| CVE-2019-11377 | 1 Wcms | 1 Wcms | 2019-04-22 | 6.5 MEDIUM | 8.8 HIGH |
| wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload Vulnerability via developer/finder because .php is a valid extension according to the fm_get_text_exts function. | |||||