Frog Cms Project Frog Cms vulnerabilities

CVE-2014-4912 [CRITICAL] CWE-434 CVE-2014-4912: An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation. An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation.

CVE-2018-8908 [HIGH] CWE-352 CVE-2018-8908: An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functiona An issue was discovered in /admin/?/user/add in Frog CMS 0.9.5. The application's add user functionality suffers from CSRF. A malicious user can craft an HTML page and use it to trick a victim into clicking on it; once executed, a malicious user will be created with admin privileges. This happens due to lack of an anti-CSRF token in state modification r

CVE-2018-20448 [MEDIUM] CWE-79 CVE-2018-20448: Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI. Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI.

CVE-2018-20775 [HIGH] CWE-94 CVE-2018-20775: admin/?/plugin/file_manager in Frog CMS 0.9.5 allows PHP code execution by creating a new .php file admin/?/plugin/file_manager in Frog CMS 0.9.5 allows PHP code execution by creating a new .php file containing PHP code, and then visiting this file under the public/ URI.

CVE-2018-20772 [HIGH] CWE-94 CVE-2018-20772: Frog CMS 0.9.5 allows PHP code execution via <?php to the admin/?/layout/edit/1 URI. Frog CMS 0.9.5 allows PHP code execution via <?php to the admin/?/layout/edit/1 URI.

CVE-2018-20776 [HIGH] CWE-200 CVE-2018-20776: Frog CMS 0.9.5 provides a directory listing for a /public request. Frog CMS 0.9.5 provides a directory listing for a /public request.

CVE-2018-20773 [HIGH] CWE-94 CVE-2018-20773: Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional <? Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional <?php lines.

CVE-2018-11098 [HIGH] CVE-2018-11098: An issue was discovered in Frog CMS 0.9.5. There is a file upload vulnerability via the admin/?/plug An issue was discovered in Frog CMS 0.9.5. There is a file upload vulnerability via the admin/?/plugin/file_manager/upload URI, a similar issue to CVE-2014-4912.

CVE-2019-6243 [MEDIUM] CWE-79 CVE-2019-6243: Frog CMS 0.9.5 allows XSS via the forgot password page (aka the /admin/?/login/forgot URI). Frog CMS 0.9.5 allows XSS via the forgot password page (aka the /admin/?/login/forgot URI).

CVE-2018-16373 [MEDIUM] CWE-434 CVE-2018-16373: Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/file_manager/sa Frog CMS 0.9.5 has an Upload vulnerability that can create files via /admin/?/plugin/file_manager/save.

CVE-2018-20778 [MEDIUM] CWE-79 CVE-2018-20778: admin/?/plugin/file_manager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted admin/?/plugin/file_manager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element.

CVE-2019-1010235 [MEDIUM] CWE-79 CVE-2019-1010235: Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-u Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing browser exploits. The component is: Snippets.

CVE-2018-20774 [MEDIUM] CWE-79 CVE-2018-20774: Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field. Frog CMS 0.9.5 has XSS via the admin/?/layout/edit/1 Body field.

CVE-2018-20777 [MEDIUM] CWE-79 CVE-2018-20777: Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field. Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field.

CVE-2018-16374 [MEDIUM] CWE-79 CVE-2018-16374: Frog CMS 0.9.5 has stored XSS via /admin/?/plugin/comment/settings. Frog CMS 0.9.5 has stored XSS via /admin/?/plugin/comment/settings.

CVE-2018-9992 [MEDIUM] CWE-79 CVE-2018-9992: Frog CMS 0.9.5 has XSS via the name field of a new "File" or "Directory" on the admin/?/plugin/file_ Frog CMS 0.9.5 has XSS via the name field of a new "File" or "Directory" on the admin/?/plugin/file_manager/browse/ screen.

CVE-2018-9991 [MEDIUM] CWE-79 CVE-2018-9991: Frog CMS 0.9.5 has XSS via the /admin/?/user/add Name or Username parameter. Frog CMS 0.9.5 has XSS via the /admin/?/user/add Name or Username parameter.

CVE-2018-20680 [MEDIUM] CWE-79 CVE-2018-20680: Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field. Frog CMS 0.9.5 has XSS in the admin/?/page/edit/1 body field.