1234N Minicms vulnerabilities

CVE-2018-15899 [MEDIUM] CWE-79 CVE-2018-15899: An issue was discovered in MiniCMS 1.10. There is a post.php?date= XSS vulnerability. An issue was discovered in MiniCMS 1.10. There is a post.php?date= XSS vulnerability.

CVE-2019-13186 [MEDIUM] CVE-2019-13186: In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box. An attacker can u In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, and CVE-2018-20520.

CVE-2018-16298 [MEDIUM] CWE-79 CVE-2018-16298: An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request.

CVE-2018-16233 [MEDIUM] CWE-79 CVE-2018-16233: MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter. MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.

CVE-2018-10296 [MEDIUM] CWE-79 CVE-2018-10296: MiniCMS V1.10 has XSS via the mc-admin/post-edit.php title parameter. MiniCMS V1.10 has XSS via the mc-admin/post-edit.php title parameter.

CVE-2018-20520 [MEDIUM] CVE-2018-20520: MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233.

CVE-2018-17039 [MEDIUM] CWE-79 CVE-2018-17039: MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $_SERVER['REQUEST MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $_SERVER['REQUEST_URI'] is mishandled.

CVE-2021-44970 [MEDIUM] CWE-79 CVE-2021-44970: MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/pag MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.

CVE-2024-9281 [MEDIUM] CWE-352 CVE-2024-9281: A vulnerability was found in bg5sbk MiniCMS up to 1.11 and classified as problematic. This issue aff A vulnerability was found in bg5sbk MiniCMS up to 1.11 and classified as problematic. This issue affects some unknown processing of the file post-edit.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions co

CVE-2023-46378 [MEDIUM] CWE-79 CVE-2023-46378: Stored Cross Site Scripting (XSS) vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary c Stored Cross Site Scripting (XSS) vulnerability in MiniCMS 1.1.1 allows attackers to run arbitrary code via crafted string appended to /mc-admin/conf.php.

CVE-2024-9282 [MEDIUM] CWE-352 CVE-2024-9282: A vulnerability was found in bg5sbk MiniCMS 1.11. It has been classified as problematic. Affected is A vulnerability was found in bg5sbk MiniCMS 1.11. It has been classified as problematic. Affected is an unknown function of the file page-edit.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions co

CVE-2019-13341 [MEDIUM] CWE-79 CVE-2019-13341: In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie.

CVE-2019-13340 [MEDIUM] CVE-2019-13340: In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. An attacker ca In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, CVE-2018-20520, and CVE-2019-13186.

CVE-2018-10423 [LOW] CWE-200 CVE-2018-10423: mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-l mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a link that becomes available after posting an article.

CVE-2018-10424 [LOW] CWE-200 CVE-2018-10424: mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field. mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field.