1234n

Minicms

31 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.8

CVE-2020-36052

Exploit
  • EPSS 1.7%
  • Published 05.01.2021 22:15:14
  • Last modified 21.11.2024 05:28:42

Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote attackers to include and execute arbitrary files via the state parameter.

7.5

CVE-2020-36051

Exploit
  • EPSS 0.43%
  • Published 05.01.2021 22:15:14
  • Last modified 21.11.2024 05:28:42

Directory traversal vulnerability in page_edit.php in MiniCMS V1.10 allows remote attackers to read arbitrary files via the state parameter.

4.8

CVE-2019-13341

Exploit
  • EPSS 0.22%
  • Published 05.07.2019 15:16:22
  • Last modified 21.11.2024 04:24:45

In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie.

4.8

CVE-2019-13340

Exploit
  • EPSS 0.22%
  • Published 05.07.2019 15:16:22
  • Last modified 21.11.2024 04:24:44

In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, CVE-2018-20520, and CVE-2019-13186.

4.8

CVE-2019-13339

  • EPSS 0.22%
  • Published 05.07.2019 15:16:21
  • Last modified 21.11.2024 04:24:44

In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a user's cookie.

6.1

CVE-2019-13186

Exploit
  • EPSS 0.24%
  • Published 03.07.2019 17:15:10
  • Last modified 21.11.2024 04:24:22

In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, and CVE-2018-20520.

6.5

CVE-2019-9603

Exploit
  • EPSS 0.1%
  • Published 06.03.2019 19:29:00
  • Last modified 21.11.2024 04:51:56

MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891.

6.1

CVE-2018-20520

Exploit
  • EPSS 0.24%
  • Published 27.12.2018 15:29:00
  • Last modified 21.11.2024 04:01:38

MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233.

9.8

CVE-2018-18892

Exploit
  • EPSS 1.19%
  • Published 01.11.2018 01:29:00
  • Last modified 21.11.2024 03:56:50

MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the site_name field in mc_conf.php.

7.5

CVE-2018-18891

Exploit
  • EPSS 0.38%
  • Published 01.11.2018 01:29:00
  • Last modified 21.11.2024 03:56:49

MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late.