1234n minicms 1.10 vulnerabilities and exploits

(subscribe to this query)

8.8

CVSSv3

There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password.

1234n Minicms 1.10

1 EDB exploit

6.5

CVSSv3

MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891.

1234n Minicms 1.10

2.7

CVSSv3

mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field.

1234n Minicms 1.10

6.1

CVSSv3

Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote malicious users to execute arbitrary code by injecting commands via a crafted HTTP request to the component "/mc-admin/post-edit.php".

1234n Minicms 1.10

6.1

CVSSv3

MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $_SERVER['REQUEST_URI'] is mishandled.

1234n Minicms 1.10

4.8

CVSSv3

In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a user's cookie.

1234n Minicms 1.10

7.5

CVSSv3

Directory traversal vulnerability in page_edit.php in MiniCMS V1.10 allows remote malicious users to read arbitrary files via the state parameter.

1234n Minicms 1.10

9.8

CVSSv3

Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote malicious users to include and execute arbitrary files via the state parameter.

1234n Minicms 1.10

7.5

CVSSv3

MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late.

1234n Minicms 1.10

6.1

CVSSv3

MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.

1234n Minicms 1.10

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook