TI-2018-14223 CVE-2018-20062 · GHSA-gf7c-4w4p-7cm5
An issue was discovered in NoneCms V1.3.
Priority CRITICAL 100KEV
An issue was discovered in NoneCms V1.3.
5none
Records12All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
5none records in CISA KEVComponents
Products in the NVD configurations · select one to filter the recordsRecords
12 records in Nonecms · all components
TI-2018-05233 CVE-2018-7219 · GHSA-c43m-pcw8-hw5p
application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by…
Priority LOW 39
application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request.
TI-2020-13416 CVE-2020-18647 · GHSA-w5g2-9x75-q8j4
Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive…
Priority LOW 36
Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information via the component "/nonecms/vendor".
TI-2020-13415 CVE-2020-18646 · GHSA-9ppm-vmxx-m22x
Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive…
Priority LOW 36
Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information via the component "/public/index.php".
TI-2018-04393 CVE-2018-6029 · GHSA-jm8p-mrcp-jgcx
The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows…
Priority LOW 36
The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery (SSRF), because URL…
TI-2018-04390 CVE-2018-6022 · GHSA-753j-q999-2725
Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms…
Priority LOW 32
Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authenticated users to delete arbitrary files by leveraging back-office access to provide a ..\ in the par…
TI-2019-12512 CVE-2019-16721 · GHSA-g7wv-2h62-m8p5
NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user.
Priority LOW 30
NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user.
TI-2020-14551 CVE-2020-23371 · GHSA-8q8m-7cq5-cxv7
Cross-site scripting (XSS) vulnerability in…
Priority LOW 29
Cross-site scripting (XSS) vulnerability in static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf in noneCms v1.3.0 allows remote attackers to inject arbitrary web script or HTML via the movieName parameter.
TI-2020-13363 CVE-2020-18282 · GHSA-8mc9-jhhx-p4q4
Cross-site scripting (XSS) vulnerability in NoneCms 1.3.0 allows remote attackers to…
Priority LOW 28
Cross-site scripting (XSS) vulnerability in NoneCms 1.3.0 allows remote attackers to inject arbitrary web script or HTML via feedback feature.
TI-2020-14554 CVE-2020-23376 · GHSA-gpxj-cjjv-pphf
NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as…
Priority LOW 27
NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parameter to launch a store…
TI-2020-14553 CVE-2020-23374 · GHSA-r32j-f8ch-p2h8
Cross-site scripting (XSS) vulnerability in admin/article/add.html in noneCMS v1.3.0…
Priority LOW 26
Cross-site scripting (XSS) vulnerability in admin/article/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter.
TI-2020-14552 CVE-2020-23373 · GHSA-g52j-gj35-mhpv
Cross-site scripting (XSS) vulnerability in admin/nav/add.html in noneCMS v1.3.0 allows…
Priority LOW 26
Cross-site scripting (XSS) vulnerability in admin/nav/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter.