Priority HIGH 76
Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.00838 · Published 2023-02-24 · No fix listed CWE-79
Priority HIGH 70
A vulnerability was determined in bg5sbk MiniCMS up to 1.8.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00574 · Published 2026-01-05 · No fix listed CWE-287
Priority HIGH 70
A vulnerability was found in bg5sbk MiniCMS up to 1.8.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00574 · Published 2026-01-05 · No fix listed CWE-287
Priority HIGH 70
A vulnerability has been found in bg5sbk MiniCMS up to 1.8.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00439 · Published 2026-01-05 · No fix listed CWE-287
Priority HIGH 70
A flaw has been found in bg5sbk MiniCMS up to 1.8.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00692 · Published 2026-01-05 · No fix listed CWE-287
Priority MEDIUM 64
A vulnerability was found in bg5sbk MiniCMS 1.11.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00317 · Published 2024-09-27 · No fix listed CWE-352
Priority MEDIUM 64
A vulnerability was found in bg5sbk MiniCMS up to 1.11 and classified as problematic.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00356 · Published 2024-09-27 · No fix listed CWE-352
Priority MEDIUM 60
Cross Site Scripting vulnerability in MiniCMS v.1.11 allows a remote attacker to run arbitrary code via crafted string in the URL after login.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00373 · Published 2024-04-26 · No fix listed CWE-79
Priority MEDIUM 58
Stored Cross Site Scripting (XSS) vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary code via crafted string appended to /mc-admin/conf.php.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00447 · Published 2023-10-31 · No fix listed CWE-79
Priority MEDIUM 47
MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the site_name field in mc_conf.php.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0258 · Published 2018-11-01 · No fix listed CWE-94
Priority MEDIUM 46
Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote attackers to include and execute arbitrary files via the state parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01927 · Published 2021-01-05 · No fix listed CWE-22
Priority MEDIUM 45
File inclusion vulnerability in Minicms v1.9 allows remote attackers to execute arbitary PHP code via post-edit.php.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01567 · Published 2022-06-28 · No fix listed
Priority MEDIUM 43
There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.02727 · Published 2018-03-27 · No fix listed CWE-352
Priority LOW 37
Directory traversal vulnerability in page_edit.php in MiniCMS V1.10 allows remote attackers to read arbitrary files via the state parameter.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01996 · Published 2021-01-05 · No fix listed CWE-22
Priority LOW 35
A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious link.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.0041 · Published 2022-06-24 · No fix listed CWE-352
Priority LOW 35
MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01175 · Published 2018-11-01 · No fix listed CWE-287
Priority LOW 32
MiniCMS version 1.1 contains a Cross Site Scripting (XSS) vulnerability in http://example.org/mc-admin/page.php?date={payload} that can result in code injection.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02191 · Published 2018-08-20 · No fix listed CWE-79
Priority LOW 30
Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP request to the component "/mc-admin/post-edit.php".
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01605 · Published 2021-04-28 · No fix listed CWE-79
Priority LOW 29
A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00785 · Published 2022-06-13 · No fix listed CWE-79
Priority LOW 29
In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00865 · Published 2019-07-03 · No fix listed CWE-79
Priority LOW 29
MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00506 · Published 2019-03-06 · No fix listed CWE-352
Priority LOW 29
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00865 · Published 2018-12-27 · No fix listed CWE-79
Priority LOW 29
MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $_SERVER['REQUEST_URI'] is mishandled.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00865 · Published 2018-09-14 · No fix listed CWE-79
Priority LOW 29
An issue was discovered in MiniCMS 1.10.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00865 · Published 2018-08-31 · No fix listed CWE-79
Priority LOW 29
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00865 · Published 2018-08-30 · No fix listed CWE-79
Load more
THREATIST.IORead the docs