Vulnerabilities

TI-2018-14104 CVE-2018-19906 · GHSA-v6w5-cm84-v59g

Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.

MEDIUM 58

Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00657 Published 2018-12-31 No fix listed CWE-79

TI-2018-14103 CVE-2018-19905 · GHSA-mpj7-9xpc-pc2q

HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.

MEDIUM 58

HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00667 Published 2018-12-31 No fix listed CWE-79

TI-2018-12805 CVE-2018-17986 · GHSA-j65x-fqv2-567h

rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user.

LOW 39

rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00614 Published 2018-10-05 No fix listed CWE-352

TI-2018-11977 CVE-2018-16727 · GHSA-qjc3-g8g2-wx93

razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.

LOW 25

razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0058 Published 2018-09-12 No fix listed CWE-79

TI-2018-11976 CVE-2018-16726 · GHSA-r4mx-p44w-rcq2

razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.

LOW 25

razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0058 Published 2018-09-12 No fix listed CWE-79

TI-2012-05002 CVE-2012-6038 · GHSA-v9jw-7cc5-cw3r

admin/core/admin_func.php in razorCMS before 1.2.1 does not properly restrict access to…

LOW 34

admin/core/admin_func.php in razorCMS before 1.2.1 does not properly restrict access to certain administrator directories and files, which allows remote authenticated users to read, edit, rename, move, copy and delete fi…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.02707 Published 2012-11-26 No fix listed CWE-22

TI-2012-04943 CVE-2012-5918 · GHSA-26x3-37g3-jpmw

razorCMS 1.2 allows remote authenticated users to access administrator directories and…

LOW 22

razorCMS 1.2 allows remote authenticated users to access administrator directories and files by creating and deleting a directory.

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.01524 Published 2012-11-19 No fix listed CWE-264

TI-2012-01680 CVE-2012-1900 · GHSA-2j52-jv7p-x34h

Cross-site request forgery (CSRF) vulnerability in admin/index.php in RazorCMS 1.2.1 and…

LOW 35

Cross-site request forgery (CSRF) vulnerability in admin/index.php in RazorCMS 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary web pages via a s…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02635 Published 2012-10-22 No fix listed CWE-352

TI-2010-04774 CVE-2010-5051 · GHSA-6hv2-q69h-5974

Cross-site scripting (XSS) vulnerability in admin/core/admin_func.php in razorCMS 1.0…

LOW 23

Cross-site scripting (XSS) vulnerability in admin/core/admin_func.php in razorCMS 1.0 stable allows remote attackers to inject arbitrary web script or HTML via the content parameter in an edit action to admin/index.php.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01528 Published 2011-11-23 No fix listed CWE-79

TI-2009-01387 CVE-2009-1463 · GHSA-8xjh-fhmf-89q3

Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to…

LOW 36

Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving content as a .php file.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01579 Published 2009-04-28 No fix listed CWE-94

TI-2009-01386 CVE-2009-1462 · GHSA-466g-m7c7-p5x4

The Security Manager in razorCMS before 0.4 does not verify the permissions of every file…

LOW 32

The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impac…

CVSS 2.0HIGH 7.2 Local No auth Interaction — EPSS 0.00403 Published 2009-04-28 No fix listed CWE-264

TI-2009-01385 CVE-2009-1461 · GHSA-jfqx-vg8w-jmcj

Cross-site scripting (XSS) vulnerability in the Create New Page form in razorCMS 0.3 RC2…

LOW 18

Cross-site scripting (XSS) vulnerability in the Create New Page form in razorCMS 0.3 RC2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Page Title field.

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.00869 Published 2009-04-28 No fix listed CWE-79

TI-2009-01384 CVE-2009-1460 · GHSA-86qj-rfhj-8qr4

razorCMS before 0.4 uses weak permissions for (1) admin/core/admin_config.php, which…

LOW 21

razorCMS before 0.4 uses weak permissions for (1) admin/core/admin_config.php, which allows local users to obtain the administrator's password hash and FTP user credentials; and (2) the root directory, (3) datastore/, an…

CVSS 2.0MEDIUM 4.6 Local No auth Interaction — EPSS 0.00416 Published 2009-04-28 No fix listed CWE-264

TI-2009-01383 CVE-2009-1459 · GHSA-wrhj-3cw9-q99g

Cross-site request forgery (CSRF) vulnerability in razorCMS before 0.4 allows remote…

LOW 31

Cross-site request forgery (CSRF) vulnerability in razorCMS before 0.4 allows remote attackers to hijack the authentication of administrators for requests that create a web page containing PHP code.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.00687 Published 2009-04-28 No fix listed CWE-352

TI-2009-01382 CVE-2009-1458 · GHSA-c8mj-m6cr-cmjp

Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in razorCMS before…

LOW 24

Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in razorCMS before 0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the slab parameter in an edit action, (2) the catname pa…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0179 Published 2009-04-28 No fix listed CWE-79

Vulnerabilities

Filters