blackcat-cms blackcat cms vulnerabilities and exploits

(subscribe to this query)

7.5

CVSSv3

Directory traversal vulnerability in widgets/logs.php in BlackCat CMS prior to 1.1.2 allows remote malicious users to read arbitrary files via a .. (dot dot) in the dl parameter.

Blackcat-cms Blackcat Cms

1 EDB exploit

NA

Cross-site scripting (XSS) vulnerability in cattranslate.php in the CatTranslate JQuery plugin in BlackCat CMS 1.0.3 and previous versions allows remote malicious users to inject arbitrary web script or HTML via the msg parameter.

Blackcat-cms Blackcat Cms

8.8

CVSSv3

An issue exists in BlackCat CMS prior to 1.4. There is a CSRF vulnerability (bypass csrf_token) that allows remote arbitrary code execution.

Blackcat-cms Blackcat Cms

6.5

CVSSv3

In BlackCat CMS 1.2, remote authenticated users can upload any file via the media upload function in backend/media/ajax_upload.php, as demonstrated by a ZIP archive that contains a .php file.

Blackcat-cms Blackcat Cms 1.2

4.8

CVSSv3

Cross-site scripting (XSS) vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated users with the Admin role to inject arbitrary web script or HTML via the search panel.

Blackcat-cms Blackcat Cms 1.3

1 Github repository

4.8

CVSSv3

Cross-site scripting (XSS) vulnerability in BlackCat CMS 1.1.2 allows remote malicious users to inject arbitrary web script or HTML via the name in a new group to backend/groups/index.php.

Blackcat-cms Blackcat Cms 1.1.2

8.8

CVSSv3

BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_create.php. NOTE: this can be exploited via CSRF.

Blackcat-cms Blackcat Cms 1.2

5.4

CVSSv3

In BlackCat CMS 1.2, backend/settings/ajax_save_settings.php allows remote authenticated users to conduct XSS attacks via the Website header or Website footer field.

Blackcat-cms Blackcat Cms 1.2

8.8

CVSSv3

In BlackCat CMS 1.2, backend/addons/install.php allows remote authenticated users to execute arbitrary PHP code via a ZIP archive that contains a .php file.

Blackcat-cms Blackcat Cms 1.2

5.4

CVSSv3

A stored cross-site scripting (XSS) vulnerability in /settings/index.php of Black Cat CMS 1.4.1 allows malicious users to execute arbitrary web scripts or HTML via a crafted payload injected into the Website header parameter.

Blackcat-cms Blackcat Cms 1.4.1

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook