Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-18125 State: PUBLISHED Published: 2021-08-30T16:04:47 Last Updated: 2024-08-04T14:00:49.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in the /plugin/ajax.php component of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Indexhibit/indexhibit/issues/20
CVE ID: CVE-2020-18126 State: PUBLISHED Published: 2021-08-30T16:04:40 Last Updated: 2024-08-04T14:00:49.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stored cross-site scripting (XSS) vulnerabilities in the Sections module of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Indexhibit/indexhibit/issues/21
CVE ID: CVE-2020-18127 State: PUBLISHED Published: 2021-08-30T16:04:39 Last Updated: 2024-08-04T14:00:48.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Indexhibit/indexhibit/issues/22 - https://cwe.mitre.org/data/definitions/23.html
CVE ID: CVE-2020-18129 State: PUBLISHED Published: 2020-10-22T20:27:59 Last Updated: 2024-08-04T14:00:49.109Z Vendors: n/a Products: n/a Problem Types: n/a Description: A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php. Additional Analyst Notes: - CVE Program Container: References: - https://baike.baidu.com/item/CSRF/2735433?fr=aladdin
CVE ID: CVE-2020-18131 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-29T16:53:48.850Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in Bluethrust Clan Scripts v4 allows attackers to escilate privledges to an arbitrary account via a crafted request to /members/console.php?cID=5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bluethrust/clanscripts/issues/27 - https://github.com/bluethrust/clanscripts
CVE ID: CVE-2020-18132 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-29T16:52:28.720Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in MIPCMS 3.6.0 allows attackers to execute arbitrary code via the category name field to categoryEdit. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sansanyun/mipcms/issues/4 - https://github.com/sansanyun/mipcms
CVE ID: CVE-2020-18144 State: PUBLISHED Published: 2021-07-14T16:55:26 Last Updated: 2024-08-04T14:00:49.052Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection Vulnerability in ECTouch v2 via the integral_min parameter in index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yundiao/ectouch/issues/1
CVE ID: CVE-2020-18145 State: PUBLISHED Published: 2021-07-14T17:02:08 Last Updated: 2024-08-04T14:00:49.163Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in umeditor v1.2.3 via /public/common/umeditor/php/getcontent.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fex-team/umeditor/issues/624
CVE ID: CVE-2020-18151 State: PUBLISHED Published: 2021-07-14T18:18:38 Last Updated: 2024-08-04T14:00:48.789Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thinkcmf/thinkcmf/issues/580
CVE ID: CVE-2020-18155 State: PUBLISHED Published: 2021-07-14T19:06:11 Last Updated: 2024-08-04T14:00:49.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/intelliants/subrion/issues/817
CVE ID: CVE-2020-18157 State: PUBLISHED Published: 2021-07-29T16:17:27 Last Updated: 2024-08-04T14:00:48.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/je6k/ctf-challenges/blob/master/poc.txt
CVE ID: CVE-2020-18158 State: PUBLISHED Published: 2021-07-29T16:26:38 Last Updated: 2024-08-04T14:00:49.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in HuCart 5.7.4 via nickname in index.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnblogs.com/echod/articles/10380909.html
CVE ID: CVE-2020-18164 State: PUBLISHED Published: 2021-08-17T19:16:13 Last Updated: 2024-08-04T14:00:48.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability exists in tp-shop 2.x-3.x via the /index.php/home/api/shop fBill parameter. Additional Analyst Notes: - CVE Program Container: References: - https://xz.aliyun.com/t/5095
CVE ID: CVE-2020-18165 State: PUBLISHED Published: 2021-05-12T17:34:25 Last Updated: 2024-08-04T14:00:49.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Website SEO Keywords" field on the page "admin/info.php?shuyu". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cumtyuanfeng/Laobancms/blob/master/vuln.md
CVE ID: CVE-2020-18166 State: PUBLISHED Published: 2021-05-14T13:09:44 Last Updated: 2024-08-04T14:00:48.929Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted File Upload in LAOBANCMS v2.0 allows remote attackers to upload arbitrary files by attaching a file with a ".jpg.php" extension to the component "admin/wenjian.php?wj=../templets/pc". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cumtyuanfeng/Laobancms/blob/master/vuln.md
CVE ID: CVE-2020-18167 State: PUBLISHED Published: 2021-05-14T13:14:28 Last Updated: 2024-08-04T14:00:48.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Homepage Introduction" field of component "admin/info.php?shuyu". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cumtyuanfeng/Laobancms/blob/master/vuln.md
CVE ID: CVE-2020-18169 State: PUBLISHED Published: 2021-07-26T18:26:17 Last Updated: 2024-08-04T14:00:48.920Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the Windows installer XML (WiX) toolset of TechSmith Snagit 19.1.1.2860 allows attackers to escalate privileges. NOTE: Exploit of the Snagit installer would require the end user to ignore other safety mechanisms provided by the Host OS. See reference document for more details Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GitHubAssessments/CVE_Assessment_04_2019/blob/master/Snagit_Report.pdf - https://docs.google.com/document/d/1W33rsdISmexLOGS4VmLUIITRU_KqGULcij1Z6Qyxsj
t_04_2019/blob/master/Snagit_Report.pdf - https://docs.google.com/document/d/1W33rsdISmexLOGS4VmLUIITRU_KqGULcij1Z6QyxsjU/edit?usp=sharing
CVE ID: CVE-2020-18170 State: PUBLISHED Published: 2021-07-26T18:26:18 Last Updated: 2024-08-04T14:00:48.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the SeChangeNotifyPrivilege component of Abloy Key Manager Version 7.14301.0.0 allows attackers to escalate privileges via a change in permissions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GitHubAssessments/CVE_Assessment_05_2019/blob/master/Key_Manager_Report.pdf
CVE ID: CVE-2020-18171 State: PUBLISHED Published: 2021-07-26T18:26:19 Last Updated: 2024-11-19T14:26:37.988Z Vendors: n/a Products: n/a Problem Types: n/a Description: TechSmith Snagit 19.1.0.2653 uses Object Linking and Embedding (OLE) which can allow attackers to obfuscate and embed crafted files used to escalate privileges. NOTE: This implies that Snagit's use of OLE is a security vulnerability unto itself and it is not. See reference document for more details Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/GitHubAssessments/CVE_Assessment_06_2019/blob/master/Snagit_Review.pdf - https://docs.google.com/document/d/1W33rsdISmexLO
tHubAssessments/CVE_Assessment_06_2019/blob/master/Snagit_Review.pdf - https://docs.google.com/document/d/1W33rsdISmexLOGS4VmLUIITRU_KqGULcij1Z6QyxsjU/edit?usp=sharing
CVE ID: CVE-2020-18172 State: PUBLISHED Published: 2021-07-26T18:26:21 Last Updated: 2024-08-04T14:00:49.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: A code injection vulnerability in the SeDebugPrivilege component of Trezor Bridge 2.0.27 allows attackers to escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GitHubAssessments/CVE_07_2019/blob/master/Report.pdf
CVE ID: CVE-2020-18173 State: PUBLISHED Published: 2021-07-26T18:26:22 Last Updated: 2024-08-04T14:00:49.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: A DLL injection vulnerability in 1password.dll of 1Password 7.3.712 allows attackers to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GitHubAssessments/CVE_Assessments_11_2019
CVE ID: CVE-2020-18174 State: PUBLISHED Published: 2021-07-26T18:26:23 Last Updated: 2024-08-04T14:00:49.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: A process injection vulnerability in setup.exe of AutoHotkey 1.1.32.00 allows attackers to escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GitHubAssessments/CVE_Assessments_02_2020
CVE ID: CVE-2020-18175 State: PUBLISHED Published: 2021-07-29T16:55:54 Last Updated: 2024-08-04T14:00:49.013Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in Metinfo 6.1.3 via a dosafety_emailadd action in basic.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sword1991912/metinfo/issues/1
CVE ID: CVE-2020-18178 State: PUBLISHED Published: 2021-05-18T18:03:38 Last Updated: 2024-08-04T14:00:48.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Neeke/HongCMS/issues/11
CVE ID: CVE-2020-18184 State: PUBLISHED Published: 2020-10-02T12:46:21 Last Updated: 2024-08-04T14:00:49.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: In PluxXml V5.7,the theme edit function /PluXml/core/admin/parametres_edittpl.php allows remote attackers to execute arbitrary PHP code by placing this code into a template. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pluxml/PluXml/issues/320
CVE ID: CVE-2020-18185 State: PUBLISHED Published: 2020-10-02T12:50:32 Last Updated: 2024-08-04T14:00:49.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a linux environment. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pluxml/PluXml/issues/321
CVE ID: CVE-2020-18190 State: PUBLISHED Published: 2020-10-02T13:12:51 Last Updated: 2024-08-04T14:00:49.038Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bludit v3.8.1 is affected by directory traversal. Remote attackers are able to delete arbitrary files via /admin/ajax/upload-profile-picture. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bludit/bludit/issues/978
CVE ID: CVE-2020-18191 State: PUBLISHED Published: 2020-10-02T13:19:53 Last Updated: 2024-08-04T14:00:48.898Z Vendors: n/a Products: n/a Problem Types: n/a Description: GetSimpleCMS-3.3.15 is affected by directory traversal. Remote attackers are able to delete arbitrary files via /GetSimpleCMS-3.3.15/admin/log.php Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1303
CVE ID: CVE-2020-18194 State: PUBLISHED Published: 2021-05-17T21:01:53 Last Updated: 2024-08-04T14:00:49.156Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in emlog v6.0.0 allows remote attackers to execute arbitrary code by adding a crafted script as a link to a new blog post. Additional Analyst Notes: - CVE Program Container: References: - https://www.lurbk.com/lur1823.html
CVE ID: CVE-2020-18195 State: PUBLISHED Published: 2021-05-17T21:01:54 Last Updated: 2024-08-04T14:00:49.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via the component " /admin.php?action=page." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pluck-cms/pluck/issues/69
CVE ID: CVE-2020-18198 State: PUBLISHED Published: 2021-05-17T21:01:55 Last Updated: 2024-08-04T14:00:49.112Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.php?action=images." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pluck-cms/pluck/issues/69
CVE ID: CVE-2020-18215 State: PUBLISHED Published: 2021-02-09T18:56:32 Last Updated: 2024-08-04T14:00:49.253Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL Injection vulnerabilities in PHPSHE 1.7 in phpshe/admin.php via the (1) ad_id, (2) menu_id, and (3) cashout_id parameters, which could let a remote malicious user execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lemon666/vuln/blob/master/Phpshe1.7_sql1.md - https://gitee.com/koyshe/phpshe/issues/ITLK2
CVE ID: CVE-2020-18220 State: PUBLISHED Published: 2021-05-20T19:55:48 Last Updated: 2024-08-04T14:00:49.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBC encryption, causes password encrypted for users to be susceptible to dictionary attacks. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/doramart/DoraCMS/issues/190
CVE ID: CVE-2020-18221 State: PUBLISHED Published: 2021-05-26T14:50:52 Last Updated: 2024-08-04T14:00:49.123Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Typora v0.9.65 and earlier allows remote attackers to execute arbitrary code by injecting commands during block rendering of a mathematical formula. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/typora/typora-issues/issues/2204
CVE ID: CVE-2020-18229 State: PUBLISHED Published: 2021-05-27T15:20:24 Last Updated: 2024-08-04T14:00:49.133Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_copyright" of component " /admin/web_config.php". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PearlyNautilus/Security-Code-Review/issues/4
CVE ID: CVE-2020-18230 State: PUBLISHED Published: 2021-05-27T15:20:15 Last Updated: 2024-08-04T14:00:49.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfg_switchshow" of component " /admin/web_config.php". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PearlyNautilus/Security-Code-Review/issues/4
CVE ID: CVE-2020-18232 State: PUBLISHED Published: 2023-08-22T00:00:00 Last Updated: 2024-10-04T16:42:34.015Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in function H5S_close in H5S.c in HDF5 1.10.4 allows remote attackers to run arbitrary code via creation of crafted file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/winson2004aa/PAAFS/tree/master/vul2
CVE ID: CVE-2020-18243 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-15T19:17:18.763Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in Enricozab CMS v.1.0 allows a remote attacker to execute arbitrary code via /hdo/hdo-view-case.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/enricozab/CMS/issues/1
CVE ID: CVE-2020-18259 State: PUBLISHED Published: 2021-11-03T17:57:34 Last Updated: 2024-08-04T14:00:49.001Z Vendors: n/a Products: n/a Problem Types: n/a Description: ED01-CMS v1.0 was discovered to contain a reflective cross-site scripting (XSS) vulnerability in the component sposts.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the Post title or Post content fields. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chilin89117/ED01-CMS/issues/1
CVE ID: CVE-2020-18261 State: PUBLISHED Published: 2021-11-03T17:57:35 Last Updated: 2024-08-04T14:00:49.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in the image upload function of ED01-CMS v1.0 allows attackers to execute arbitrary commands. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chilin89117/ED01-CMS/issues/2
CVE ID: CVE-2020-18262 State: PUBLISHED Published: 2021-11-03T17:57:35 Last Updated: 2024-08-04T14:00:49.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: ED01-CMS v1.0 was discovered to contain a SQL injection in the component cposts.php via the cid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chilin89117/ED01-CMS/issues/3
CVE ID: CVE-2020-18263 State: PUBLISHED Published: 2021-11-03T17:57:36 Last Updated: 2024-08-04T14:00:49.151Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability in the component search.php via the search parameter. This vulnerability allows attackers to access sensitive database information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/harshitbansal373/PHP-CMS/issues/1
CVE ID: CVE-2020-18264 State: PUBLISHED Published: 2021-06-07T18:24:14 Last Updated: 2024-08-04T14:00:49.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=act_edit_member". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/github123abc123?tab=projects
CVE ID: CVE-2020-18265 State: PUBLISHED Published: 2021-06-07T18:24:15 Last Updated: 2024-08-04T14:00:49.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=act_add_member". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/github123abc123/bird/issues/1
CVE ID: CVE-2020-18268 State: PUBLISHED Published: 2021-06-07T18:24:17 Last Updated: 2024-08-04T14:00:49.177Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php." Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zblogcn/zblogphp/issues/216 - https://github.com/zblogcn/zblogphp/issues/209
CVE ID: CVE-2020-18280 State: PUBLISHED Published: 2023-05-09T00:00:00.000Z Last Updated: 2025-01-29T14:51:46.650Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability found in Phodal CMD v.1.0 allows a local attacker to execute arbitrary code via the EMBED SRC function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/phodal/md/issues/20
CVE ID: CVE-2020-18282 State: PUBLISHED Published: 2023-05-08T00:00:00.000Z Last Updated: 2025-01-29T16:51:26.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in NoneCms 1.3.0 allows remote attackers to inject arbitrary web script or HTML via feedback feature. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nangge/noneCms/issues/23 - https://github.com/nangge/noneCms
CVE ID: CVE-2020-18305 State: PUBLISHED Published: 2024-05-13T15:43:43.670Z Last Updated: 2025-02-13T15:46:13.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers to access sensitive information or escalate privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gist.github.com/yasinyilmaz/1fe3fe58dd275edb77dcbe890fce2f2c
CVE ID: CVE-2020-18324 State: PUBLISHED Published: 2022-03-04T14:15:54 Last Updated: 2024-08-04T14:00:49.175Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template. Additional Analyst Notes: - CVE Program Container: References: - http://subrion.com - http://intelliants.com - https://github.com/hamm0nz/CVE-2020-18324
CVE ID: CVE-2020-18325 State: PUBLISHED Published: 2022-03-04T14:15:57 Last Updated: 2024-08-04T14:00:49.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel. Additional Analyst Notes: - CVE Program Container: References: - http://subrion.com - http://intelliants.com - https://github.com/hamm0nz/CVE-2020-18325
CVE ID: CVE-2020-18326 State: PUBLISHED Published: 2022-03-04T14:15:37 Last Updated: 2024-08-04T14:00:49.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unauthenticated malicious user send an authorised request to victim and successfully create an arbitrary administrator user. Additional Analyst Notes: - CVE Program Container: References: - http://subrion.com - http://intelliants.com - https://github.com/hamm0nz/CVE-2020-18326