Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-20473 State: PUBLISHED Published: 2021-06-21T04:06:47 Last Updated: 2024-08-04T14:22:25.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: White Shark System (WSS) 1.3.2 has a SQL injection vulnerability. The vulnerability stems from the control_task.php, control_project.php, default_user.php files failing to filter the sort parameter. Remote attackers can exploit the vulnerability to obtain database sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/itodaro/WhiteSharkSystem_cve
CVE ID: CVE-2020-20474 State: PUBLISHED Published: 2021-06-21T04:07:37 Last Updated: 2024-08-04T14:22:24.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: White Shark System (WSS) 1.3.2 has a SQL injection vulnerability. The vulnerability stems from the default_task_edituser.php files failing to filter the csa_to_user parameter. Remote attackers can exploit the vulnerability to obtain database sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/itodaro/WhiteSharkSystem_cve
CVE ID: CVE-2020-20486 State: PUBLISHED Published: 2021-08-31T22:22:31 Last Updated: 2024-08-04T14:22:25.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: IEC104 v1.0 contains a stack-buffer overflow in the parameter Iec10x_Sta_Addr. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/airpig2011/IEC104/issues/14
CVE ID: CVE-2020-20490 State: PUBLISHED Published: 2021-08-31T22:22:32 Last Updated: 2024-08-04T14:22:24.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap buffer-overflow in the client_example1.c component of libiec_iccp_mod v1.5 leads to a denial of service (DOS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fcovatti/libiec_iccp_mod/issues/5
CVE ID: CVE-2020-20491 State: PUBLISHED Published: 2023-06-20T00:00:00 Last Updated: 2024-12-10T19:51:53.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute arbitrary code via the Fba plugin function in upload/admin/index.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opencart/opencart/issues/7612
CVE ID: CVE-2020-20495 State: PUBLISHED Published: 2021-08-31T23:07:24 Last Updated: 2024-08-04T14:22:24.532Z Vendors: n/a Products: n/a Problem Types: n/a Description: bludit v3.13.0 contains an arbitrary file deletion vulnerability in the backup plugin via the `deleteBackup' parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bludit/bludit/issues/1246
CVE ID: CVE-2020-20502 State: PUBLISHED Published: 2023-06-20T00:00:00 Last Updated: 2024-12-10T18:28:27.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery found in yzCMS v.2.0 allows a remote attacker to execute arbitrary code via the token check function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.yzmcms.com/ - https://github.com/yzmcms/yzmcms/issues/27
CVE ID: CVE-2020-20508 State: PUBLISHED Published: 2021-09-24T21:27:34 Last Updated: 2024-08-04T14:22:25.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shopkit v2.7 contains a reflective cross-site scripting (XSS) vulnerability in the /account/register component, which allows attackers to hijack user credentials via a crafted payload in the E-Mail text field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/samnabi/shopkit/issues/223
CVE ID: CVE-2020-20514 State: PUBLISHED Published: 2021-09-24T21:27:38 Last Updated: 2024-08-04T14:22:25.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/magicblack/maccms10/issues/76
CVE ID: CVE-2020-20521 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-14T18:19:31.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the comment parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Kitesky/KiteCMS/issues/1
CVE ID: CVE-2020-20522 State: PUBLISHED Published: 2023-04-04T00:00:00.000Z Last Updated: 2025-02-14T16:13:12.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the registering user parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Kitesky/KiteCMS/issues/1
CVE ID: CVE-2020-20523 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T19:27:45.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in adm_user parameter in Gila CMS version 1.11.3, allows remote attackers to execute arbitrary code during the Gila CMS installation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/GilaCMS/gila/issues/41
CVE ID: CVE-2020-20545 State: PUBLISHED Published: 2021-03-30T02:17:51 Last Updated: 2024-08-04T14:22:25.087Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) vulnerability in Zhiyuan G6 Government Collaboration System V6.1SP1, via the 'method' parameter to 'seeyon/hrSalary.do'. Additional Analyst Notes: - CVE Program Container: References: - http://note.youdao.com/noteshare?id=51d8946722c0304b5bfd72da03eaf013&sub=BDBAD6EDD2C941C18AB57141313AB5FE - http://note.youdao.com/noteshare?id=29f908204968a79233c1c0c80a59f8ff&sub=AFA8E81AA31C4482974869C5DFE07033
CVE ID: CVE-2020-20582 State: PUBLISHED Published: 2021-07-08T15:44:25 Last Updated: 2024-08-04T14:22:25.105Z Vendors: n/a Products: n/a Problem Types: n/a Description: A server side request forgery (SSRF) vulnerability in /ApiAdminDomainSettings.php of MipCMS 5.0.1 allows attackers to access sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sansanyun/mipcms5/issues/5
CVE ID: CVE-2020-20583 State: PUBLISHED Published: 2021-07-08T15:44:28 Last Updated: 2024-08-04T14:22:25.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in /question.php of LJCMS Version v4.3.R60321 allows attackers to obtain sensitive database information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/0xyu/PHP_Learning/issues/1
CVE ID: CVE-2020-20584 State: PUBLISHED Published: 2021-07-08T15:44:29 Last Updated: 2024-08-04T14:22:25.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross site scripting vulnerability in baigo CMS v4.0-beta-1 allows attackers to execute arbitrary web scripts or HTML via the form parameter post to /public/console/profile/info-submit/. Additional Analyst Notes: - CVE Program Container: References: - http://baigosso.com - https://github.com/baigoStudio/baigoSSO - https://github.com/baigoStudio/baigoSSO/ - https://github.com/baigoStudio/baigoSSO/issues/13
CVE ID: CVE-2020-20585 State: PUBLISHED Published: 2021-07-08T15:44:30 Last Updated: 2024-08-04T14:22:24.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information. Additional Analyst Notes: - CVE Program Container: References: - https://www.metinfo.cn/ - http://metinfo.com - https://github.com/0xyu/PHP_Learning/issues/3
CVE ID: CVE-2020-20586 State: PUBLISHED Published: 2021-07-08T15:44:32 Last Updated: 2024-08-04T14:22:24.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross site request forgery (CSRF) vulnerability in the /xyhai.php?s=/Auth/editUser URI of XYHCMS V3.6 allows attackers to edit any information of the administrator such as the name, e-mail, and password. Additional Analyst Notes: - CVE Program Container: References: - http://www.xyhcms.com/Show/download/id/2/at/0.html - http://xyhcms.com - https://github.com/0xyu/PHP_Learning/issues/4
CVE ID: CVE-2020-20588 State: PUBLISHED Published: 2022-12-15T00:00:00.000Z Last Updated: 2025-04-21T19:15:38.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: File upload vulnerability in function upload in action/Core.class.php in zhimengzhe iBarn 1.5 allows remote attackers to run arbitrary code via avatar upload to index.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/zhimengzhe/iBarn/issues/13
CVE ID: CVE-2020-20589 State: PUBLISHED Published: 2022-12-15T00:00:00.000Z Last Updated: 2025-04-21T19:14:46.832Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/liufee/cms/issues/45
CVE ID: CVE-2020-20593 State: PUBLISHED Published: 2021-12-22T22:35:20 Last Updated: 2024-08-04T14:22:25.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/alixiaowei/alixiaowei.github.io/issues/1 - http://www.rockoa.com/view_demo.html
CVE ID: CVE-2020-20595 State: PUBLISHED Published: 2021-12-22T22:39:44 Last Updated: 2024-08-04T14:22:25.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery (CSRF) in OPMS v1.3 and below allows attackers to arbitrarily add a user account via /user/add. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lock-upme/OPMS/issues/25
CVE ID: CVE-2020-20597 State: PUBLISHED Published: 2021-12-22T22:40:17 Last Updated: 2024-08-04T14:22:25.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the potrtalItemName parameter in \web\PortalController.java of lemon V1.10.0 allows attackers to execute arbitrary web scripts or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xuhuisheng/lemon/issues/198
CVE ID: CVE-2020-20598 State: PUBLISHED Published: 2021-12-22T22:40:43 Last Updated: 2024-08-04T14:22:25.418Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Editing component of lemon V1.10.0 allows attackers to execute arbitrary web scripts or HTML. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xuhuisheng/lemon/issues/199
CVE ID: CVE-2020-20600 State: PUBLISHED Published: 2021-12-22T22:41:06 Last Updated: 2024-08-04T14:22:25.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/alixiaowei/cve_test/issues/2
CVE ID: CVE-2020-20601 State: PUBLISHED Published: 2021-12-22T22:43:08 Last Updated: 2024-08-04T14:22:25.124Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://blog.riskivy.com/thinkcmf-%e6%a1%86%e6%9e%b6%e4%b8%8a%e7%9a%84%e4%bb%bb%e6%84%8f%e5%86%85%e5%ae%b9%e5%8c%85%e5%90%ab%e6%bc%8f%e6%b4%9e/
CVE ID: CVE-2020-20605 State: PUBLISHED Published: 2021-12-22T22:43:32 Last Updated: 2024-08-04T14:22:25.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: Blog CMS v1.0 contains a cross-site scripting (XSS) vulnerability in the /controller/CommentAdminController.java component. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xuzijia/blog/issues/4
CVE ID: CVE-2020-20625 State: PUBLISHED Published: 2020-08-31T15:52:52 Last Updated: 2024-08-04T14:22:25.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php. Additional Analyst Notes: - CVE Program Container: References: - https://blog.nintechnet.com/multiple-vulnerabilities-in-sliced-invoices-plugin/
CVE ID: CVE-2020-20626 State: PUBLISHED Published: 2020-08-31T15:56:45 Last Updated: 2024-08-04T14:22:25.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://blog.nintechnet.com/zero-day-vulnerability-exploited-in-wordpress-lara-google-analytics-plugin/
CVE ID: CVE-2020-20627 State: PUBLISHED Published: 2020-08-31T16:00:05 Last Updated: 2024-08-04T14:22:25.393Z Vendors: n/a Products: n/a Problem Types: n/a Description: The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change. Additional Analyst Notes: - CVE Program Container: References: - https://blog.nintechnet.com/multiple-vulnerabilities-fixed-in-wordpress-givewp-plugin/
CVE ID: CVE-2020-20628 State: PUBLISHED Published: 2020-08-31T16:07:05 Last Updated: 2024-08-04T14:22:25.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS. Additional Analyst Notes: - CVE Program Container: References: - https://blog.nintechnet.com/unauthenticated-stored-xss-and-content-spoofing-vulnerabilities-in-wordpress-wp-gdpr-plugin-unpatched/
CVE ID: CVE-2020-20633 State: PUBLISHED Published: 2020-08-21T15:42:06 Last Updated: 2024-08-04T14:22:25.482Z Vendors: n/a Products: n/a Problem Types: n/a Description: ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent (cookie-law-info) 1.8.2 and below plugin for WordPress, allows authenticated stored XSS and privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://blog.nintechnet.com/wordpress-gdpr-cookie-consent-plugin-fixed-vulnerability/
CVE ID: CVE-2020-20634 State: PUBLISHED Published: 2020-08-21T14:52:22 Last Updated: 2024-08-04T14:22:25.364Z Vendors: n/a Products: n/a Problem Types: n/a Description: Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins on the blog. Additional Analyst Notes: - CVE Program Container: References: - https://blog.nintechnet.com/wordpress-elementor-plugin-fixed-safe-mode-privilege-escalation-vulnerability/
CVE ID: CVE-2020-20636 State: PUBLISHED Published: 2023-06-20T00:00:00 Last Updated: 2024-12-10T18:23:01.829Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in Joyplus-cms v.1.6.0 allows a remote attacker to access sensitive information via the id parameter of the goodbad() function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/joyplus/joyplus-cms/issues/447
CVE ID: CVE-2020-20640 State: PUBLISHED Published: 2021-06-28T17:29:08 Last Updated: 2024-08-04T14:22:25.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in ECShop 4.0 due to security filtering issues, in the user.php file, we can use the html entity encoding to bypass the security policy of the safety.php file, triggering the xss vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.jianshu.com/p/219755c047a1
CVE ID: CVE-2020-20642 State: PUBLISHED Published: 2021-08-19T18:01:33 Last Updated: 2024-08-04T14:22:25.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eyoucms/eyoucms/issues/5
CVE ID: CVE-2020-20645 State: PUBLISHED Published: 2021-08-19T18:16:26 Last Updated: 2024-08-04T14:22:25.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in EyouCMS1.3.6 in the basic_information area. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eyoucms/eyoucms/issues/6
CVE ID: CVE-2020-20657 State: PUBLISHED Published: 2021-11-02T17:45:01 Last Updated: 2024-08-04T14:22:25.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in fcovatti libiec_iccp_mod v1.5, allows attackers to cause a denial of service via an unexpected packet while trying to connect. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fcovatti/libiec_iccp_mod/issues/1
CVE ID: CVE-2020-20658 State: PUBLISHED Published: 2021-11-02T17:45:02 Last Updated: 2024-08-04T14:22:25.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow vulnerability in fcovatti libiec_iccp_mod v1.5, allows attackers to cause a denail of service when trying to calloc an unexpectiedly large space. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fcovatti/libiec_iccp_mod/issues/2
CVE ID: CVE-2020-20662 State: PUBLISHED Published: 2021-09-30T16:40:49 Last Updated: 2024-08-04T14:22:25.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_example1.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fcovatti/libiec_iccp_mod/issues/6
CVE ID: CVE-2020-20663 State: PUBLISHED Published: 2021-09-30T16:40:51 Last Updated: 2024-08-04T14:22:25.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: libiec_iccp_mod v1.5 contains a heap-buffer-overflow in the component mms_client_connection.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fcovatti/libiec_iccp_mod/issues/7
CVE ID: CVE-2020-20664 State: PUBLISHED Published: 2021-09-30T16:40:52 Last Updated: 2024-08-04T14:22:25.283Z Vendors: n/a Products: n/a Problem Types: n/a Description: libiec_iccp_mod v1.5 contains a segmentation violation in the component server_example1.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fcovatti/libiec_iccp_mod/issues/8
CVE ID: CVE-2020-20665 State: PUBLISHED Published: 2021-09-30T16:40:54 Last Updated: 2024-08-04T14:22:25.436Z Vendors: n/a Products: n/a Problem Types: n/a Description: rudp v0.6 was discovered to contain a memory leak in the component main.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cloudwu/rudp/issues/6 - https://cwe.mitre.org/data/definitions/401.html
CVE ID: CVE-2020-20670 State: PUBLISHED Published: 2021-09-13T21:13:08 Last Updated: 2024-08-04T14:22:25.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in /admin/media/upload of ZKEACMS V3.2.0 allows attackers to execute arbitrary code via a crafted HTML file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yilezhu/Czar.Cms/issues/6
CVE ID: CVE-2020-20671 State: PUBLISHED Published: 2021-09-13T21:13:09 Last Updated: 2024-08-04T14:22:25.071Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site request forgery (CSRF) in KiteCMS V1.1 allows attackers to arbitrarily add an administrator account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Kitesky/KiteCMS/issues/3
CVE ID: CVE-2020-20672 State: PUBLISHED Published: 2021-09-13T21:13:10 Last Updated: 2024-08-04T14:22:25.360Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file upload vulnerability in /admin/upload/uploadfile of KiteCMS V1.1 allows attackers to getshell via a crafted PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Kitesky/KiteCMS/issues/3
CVE ID: CVE-2020-20675 State: PUBLISHED Published: 2021-08-26T21:11:44 Last Updated: 2024-08-04T14:22:25.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nuishop v2.3 contains a SQL injection vulnerability in /goods/getGoodsListByConditions/. Additional Analyst Notes: - CVE Program Container: References: - https://xz.aliyun.com/t/6758#toc-2
CVE ID: CVE-2020-20691 State: PUBLISHED Published: 2021-09-27T21:34:17 Last Updated: 2024-08-04T14:22:25.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via bypassing the file extension filter and uploading crafted HTML files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/monstra-cms/monstra/issues/461
CVE ID: CVE-2020-20692 State: PUBLISHED Published: 2021-09-27T21:34:17 Last Updated: 2024-08-04T14:22:25.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: GilaCMS v1.11.4 was discovered to contain a SQL injection vulnerability via the $_GET parameter in /src/core/controllers/cm.php. Additional Analyst Notes: - CVE Program Container: References: - http://test.lingdong.store/2019/10/13/SQL-injection-in-Gila-CMS-version-1-11-4/ - https://github.com/GilaCMS/gila/issues/50
CVE ID: CVE-2020-20693 State: PUBLISHED Published: 2021-09-27T21:34:28 Last Updated: 2024-08-04T14:22:25.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GilaCMS/gila/issues/51
CVE ID: CVE-2020-20695 State: PUBLISHED Published: 2021-09-27T21:34:19 Last Updated: 2024-08-04T14:22:25.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GilaCMS/gila/issues/52
CVE ID: CVE-2020-20696 State: PUBLISHED Published: 2021-09-27T21:34:19 Last Updated: 2024-08-04T14:22:25.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Tags field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/GilaCMS/gila/issues/53
CVE ID: CVE-2020-20697 State: PUBLISHED Published: 2023-06-20T00:00:00 Last Updated: 2024-12-10T18:19:50.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in khodakhah NodCMS v.3.0 allows a remote attacker to execute arbitrary code and gain access to senstivie information via a crafted script to the address parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/khodakhah/nodcms/issues/41
CVE ID: CVE-2020-20698 State: PUBLISHED Published: 2021-07-27T22:19:25 Last Updated: 2024-08-04T14:22:25.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability in /1.com.php of S-CMS PHP v3.0 allows attackers to getshell via modification of a PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Peithon/vul/blob/master/readme.md