WBCE 漏洞列表
共找到 10 个与 WBCE 相关的漏洞
📅 加载漏洞趋势中...
-
CVE-2022-30073: WBCE CMS 1.5.2 - Cross-Site Scripting POC
WBCE CMS 1.5.2 contains a stored cross-site scripting vulnerability via \admin\user\save.php Display Name parameters. -
CVE-2022-45037: WBCE CMS v1.5.4 - Cross Site Scripting (Stored) POC
A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field. -
CVE-2022-45038: WBCE CMS v1.5.4 - Cross Site Scripting (Stored) POC
A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field. -
CVE-2022-46020: WBCE CMS v1.5.4 - Remote Code Execution POC
WBCE CMS v1.5.4 can implement getshell by modifying the upload file type. -
CVE-2023-39796: WBCE 1.6.0 - SQL Injection POC
There is an sql injection vulnerability in "miniform module" which is a default module installed in the WBCE cms. It is an unauthenticated sqli so anyone could access it and takeover the whole database. In file "/modules/miniform/ajax_delete_message.php" there is no authentication check. On line 40 in this file, there is a DELETE query that is vulnerable, an attacker could jump from the query using the tick sign - `. -
CVE-2022-30073: WBCE CMS 1.5.2 - Cross-Site Scripting POC
WBCE CMS 1.5.2 contains a stored cross-site scripting vulnerability via \admin\user\save.php Display Name parameters. -
CVE-2022-45037: WBCE CMS v1.5.4 - Cross Site Scripting (Stored) POC
A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field. -
CVE-2022-45038: WBCE CMS v1.5.4 - Cross Site Scripting (Stored) POC
A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field. -
CVE-2022-46020: WBCE CMS v1.5.4 - Remote Code Execution POC
WBCE CMS v1.5.4 can implement getshell by modifying the upload file type. -
CVE-2023-39796: WBCE 1.6.0 - SQL Injection POC
There is an sql injection vulnerability in "miniform module" which is a default module installed in the WBCE cms. It is an unauthenticated sqli so anyone could access it and takeover the whole database. In file "/modules/miniform/ajax_delete_message.php" there is no authentication check. On line 40 in this file, there is a DELETE query that is vulnerable, an attacker could jump from the query using the tick sign - `.