5None Nonecms vulnerabilities
12 known vulnerabilities affecting 5none/nonecms.
Total CVEs
12
CISA KEV
1
actively exploited
Public exploits
1
Exploited in wild
1
Severity breakdown
CRITICAL1HIGH4MEDIUM7
Vulnerabilities
Page 1 of 1
CVE-2018-20062P1CRITICALCVSS 9.8KEVPoCv1.3.02018-12-11
CVE-2018-20062 [CRITICAL] CVE-2018-20062: An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to e
An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\think\Request/input&filter=phpinfo&data=1 query string.
nvd
CVE-2018-6029P3HIGHCVSS 7.5v1.3.02018-01-23
CVE-2018-6029 [HIGH] CWE-918 CVE-2018-6029: The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attacke
The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery (SSRF), because URL validation only considers whether the URL contains the "csdn" substring.
nvd
CVE-2020-18647P3HIGHCVSS 7.5v1.3.02021-06-22
CVE-2020-18647 [HIGH] CWE-668 CVE-2020-18647: Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information via t
Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information via the component "/nonecms/vendor".
nvd
CVE-2020-18646P3HIGHCVSS 7.5v1.3.02021-06-22
CVE-2020-18646 [HIGH] CWE-668 CVE-2020-18646: Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information via t
Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information via the component "/public/index.php".
nvd
CVE-2018-6022P3MEDIUMCVSS 6.5≤ 1.3.02018-01-23
CVE-2018-6022 [MEDIUM] CWE-22 CVE-2018-6022: Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0
Directory traversal vulnerability in application/admin/controller/Main.php in NoneCms through 1.3.0 allows remote authenticated users to delete arbitrary files by leveraging back-office access to provide a ..\ in the param.path parameter.
nvd
CVE-2018-7219P4HIGHCVSS 8.8v1.3.02018-02-19
CVE-2018-7219 [HIGH] CWE-352 CVE-2018-7219: application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an adm
application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request.
nvd
CVE-2019-16721P4MEDIUMCVSS 6.5v1.3.02019-09-23
CVE-2019-16721 [MEDIUM] CWE-352 CVE-2019-16721: NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the adm
NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user.
nvd
CVE-2020-18282P4MEDIUMCVSS 6.1v1.3.02023-05-08
CVE-2020-18282 [MEDIUM] CWE-79 CVE-2020-18282: Cross-site scripting (XSS) vulnerability in NoneCms 1.3.0 allows remote attackers to inject arbitrar
Cross-site scripting (XSS) vulnerability in NoneCms 1.3.0 allows remote attackers to inject arbitrary web script or HTML via feedback feature.
nvd
CVE-2020-23376P4MEDIUMCVSS 6.1v1.3.02021-05-10
CVE-2020-23376 [MEDIUM] CWE-352 CVE-2020-23376: NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by add
NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parameter to launch a stored XSS attack.
nvd
CVE-2020-23371P4MEDIUMCVSS 6.1v1.3.02021-05-10
CVE-2020-23371 [MEDIUM] CWE-79 CVE-2020-23371: Cross-site scripting (XSS) vulnerability in static/admin/js/kindeditor/plugins/multiimage/images/swf
Cross-site scripting (XSS) vulnerability in static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf in noneCms v1.3.0 allows remote attackers to inject arbitrary web script or HTML via the movieName parameter.
nvd
CVE-2020-23374P4MEDIUMCVSS 5.4v1.3.02021-05-10
CVE-2020-23374 [MEDIUM] CWE-79 CVE-2020-23374: Cross-site scripting (XSS) vulnerability in admin/article/add.html in noneCMS v1.3.0 allows remote a
Cross-site scripting (XSS) vulnerability in admin/article/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter.
nvd
CVE-2020-23373P4MEDIUMCVSS 5.4v1.3.02021-05-10
CVE-2020-23373 [MEDIUM] CWE-79 CVE-2020-23373: Cross-site scripting (XSS) vulnerability in admin/nav/add.html in noneCMS v1.3.0 allows remote authe
Cross-site scripting (XSS) vulnerability in admin/nav/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter.
nvd