← Back

Weaselcms Project

weaselcms_project

5 CVEs • 1 product

Products (1)

Click to collapse
Toggle
Weaselcms
weaselcms
5 CVEs

CVEs (5)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2018-17361
1Weaselcms Project
1Weaselcms
Nov 21, 2024
Sep 23, 2018
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Multiple XSS vulnerabilities in WeaselCMS v0.3.6 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php because $_SERVER['PHP_SELF'] is mishandled.
CVE-2018-16352
1Weaselcms Project
1Weaselcms
Nov 21, 2024
Sep 2, 2018
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
There is a PHP code upload vulnerability in WeaselCMS 0.3.6 via index.php because code can be embedded at the end of a .png file when the image/png content type is used.
CVE-2018-14959
1Weaselcms Project
1Weaselcms
Nov 21, 2024
Aug 5, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
An issue was discovered in WeaselCMS v0.3.5. CSRF can create new pages via an index.php?b=pages&a=new URI.
CVE-2018-14958
1Weaselcms Project
1Weaselcms
Nov 21, 2024
Aug 5, 2018
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings (such as the theme, title, and description) via index.php.
CVE-2018-14877
1Weaselcms Project
1Weaselcms
Nov 21, 2024
Aug 3, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in WeaselCMS v0.3.5. XSS exists via Site Language, Site Title, Site Description, and Site Keywords on the SETTINGS page.