Evo Evolution Cms vulnerabilities

CVE-2021-47939 [HIGH] CWE-94 CVE-2021-47939: Evolution CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated users w Evolution CMS 3.1.6 contains a remote code execution vulnerability that allows authenticated users with module creation permissions to execute arbitrary system commands by injecting PHP code into module parameters. Attackers can send POST requests to /manager/index.php with malicious PHP code in the 'post' parameter to create modules that execute arbit

CVE-2023-43341 [MEDIUM] CWE-79 CVE-2023-43341: Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter.

CVE-2020-23238 [MEDIUM] CWE-79 CVE-2020-23238: Cross Site Scripting (XSS) vulnerability in Evolution CMS 2.0.2 via the Document Manager feature. Cross Site Scripting (XSS) vulnerability in Evolution CMS 2.0.2 via the Document Manager feature.

CVE-2023-43340 [MEDIUM] CWE-79 CVE-2023-43340: Cross-site scripting (XSS) vulnerability in evolution v.3.2.3 allows a local attacker to execute arb Cross-site scripting (XSS) vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmin, cmsadminemail, cmspassword and cmspasswordconfim parameters