TI-2018-14104 CVE-2018-19906 · GHSA-v6w5-cm84-v59g
Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.
Priority MEDIUM 58
Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.
Razorcms
Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
Razorcms records in CISA KEVNo Razorcms vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
15 records in Razorcms · all components
TI-2018-14103 CVE-2018-19905 · GHSA-mpj7-9xpc-pc2q
HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.
Priority MEDIUM 58
HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.
TI-2018-12805 CVE-2018-17986 · GHSA-j65x-fqv2-567h
rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user.
Priority LOW 39
rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user.
TI-2009-01387 CVE-2009-1463 · GHSA-8xjh-fhmf-89q3
Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to…
Priority LOW 36
Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving content as a .php file.
TI-2012-01680 CVE-2012-1900 · GHSA-2j52-jv7p-x34h
Cross-site request forgery (CSRF) vulnerability in admin/index.php in RazorCMS 1.2.1 and…
Priority LOW 35
Cross-site request forgery (CSRF) vulnerability in admin/index.php in RazorCMS 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary web pages via a s…
TI-2012-05002 CVE-2012-6038 · GHSA-v9jw-7cc5-cw3r
admin/core/admin_func.php in razorCMS before 1.2.1 does not properly restrict access to…
Priority LOW 34
admin/core/admin_func.php in razorCMS before 1.2.1 does not properly restrict access to certain administrator directories and files, which allows remote authenticated users to read, edit, rename, move, copy and delete fi…
TI-2009-01386 CVE-2009-1462 · GHSA-466g-m7c7-p5x4
The Security Manager in razorCMS before 0.4 does not verify the permissions of every file…
Priority LOW 32
The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impac…
TI-2009-01383 CVE-2009-1459 · GHSA-wrhj-3cw9-q99g
Cross-site request forgery (CSRF) vulnerability in razorCMS before 0.4 allows remote…
Priority LOW 31
Cross-site request forgery (CSRF) vulnerability in razorCMS before 0.4 allows remote attackers to hijack the authentication of administrators for requests that create a web page containing PHP code.
TI-2018-11977 CVE-2018-16727 · GHSA-qjc3-g8g2-wx93
razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.
Priority LOW 25
razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.
TI-2018-11976 CVE-2018-16726 · GHSA-r4mx-p44w-rcq2
razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.
Priority LOW 25
razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.
TI-2009-01382 CVE-2009-1458 · GHSA-c8mj-m6cr-cmjp
Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in razorCMS before…
Priority LOW 24
Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in razorCMS before 0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the slab parameter in an edit action, (2) the catname pa…
TI-2010-04774 CVE-2010-5051 · GHSA-6hv2-q69h-5974
Cross-site scripting (XSS) vulnerability in admin/core/admin_func.php in razorCMS 1.0…
Priority LOW 23
Cross-site scripting (XSS) vulnerability in admin/core/admin_func.php in razorCMS 1.0 stable allows remote attackers to inject arbitrary web script or HTML via the content parameter in an edit action to admin/index.php.
TI-2012-04943 CVE-2012-5918 · GHSA-26x3-37g3-jpmw
razorCMS 1.2 allows remote authenticated users to access administrator directories and…
Priority LOW 22
razorCMS 1.2 allows remote authenticated users to access administrator directories and files by creating and deleting a directory.
TI-2009-01384 CVE-2009-1460 · GHSA-86qj-rfhj-8qr4
razorCMS before 0.4 uses weak permissions for (1) admin/core/admin_config.php, which…
Priority LOW 21
razorCMS before 0.4 uses weak permissions for (1) admin/core/admin_config.php, which allows local users to obtain the administrator's password hash and FTP user credentials; and (2) the root directory, (3) datastore/, an…
TI-2009-01385 CVE-2009-1461 · GHSA-jfqx-vg8w-jmcj
Cross-site scripting (XSS) vulnerability in the Create New Page form in razorCMS 0.3 RC2…
Priority LOW 18
Cross-site scripting (XSS) vulnerability in the Create New Page form in razorCMS 0.3 RC2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Page Title field.