Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2018-25431

No-Cms 1.0 SQL Injection via order_by Parameter

No-Cms 1.0 contains an SQL injection vulnerability in the order_by parameter of the manage_privilege export endpoint that allows authenticated attackers to manipulate database queries. Attackers can submit POST requests to /nocms/main/manage_privilege/index/export with malicious SQL code in the order_by[0] parameter to extract sensitive database information.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Gofrendiasgard No-cms Project
Products
No-cms No-cms
CVE-2018-19902

No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article "keyword" parameter.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
No-cms Project
Products
No-cms
CVE-2018-19901

No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article/index/ "article_title" parameter.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
No-cms Project
Products
No-cms
CVE-2018-18868

No-CMS 1.1.3 is prone to Persistent XSS via a contact_us name parameter, as demonstrated by the VG48Z5PqVWname parameter.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
No-cms Project
Products
No-cms