Vulnerabilities > Kasseler CMS
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2014-03-13 | CVE-2013-3729 | Cross-Site Request Forgery (CSRF) vulnerability in Kasseler-Cms Multiple cross-site request forgery (CSRF) vulnerabilities in Kasseler CMS before 2 r1232 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) groups[] parameter in a send action in the sendmail module or (2) query parameter in a sql_query action in the database module to admin.php, related to CVE-2013-3727. | 6.8 |
2014-03-13 | CVE-2013-3728 | Cross-Site Scripting vulnerability in Kasseler-Cms Cross-site scripting (XSS) vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users with permissions to create categories to inject arbitrary web script or HTML via the cat parameter in an admin_new_category action to admin.php. | 3.5 |
2014-03-13 | CVE-2013-3727 | SQL Injection vulnerability in Kasseler-Cms SQL injection vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users to execute arbitrary SQL commands via the groups[] parameter to admin.php. | 7.5 |
2010-04-27 | CVE-2009-4822 | Cross-Site Scripting vulnerability in Kasseler-Cms Kasseler CMS 1.3.4 Multiple cross-site scripting (XSS) vulnerabilities in index.php in Kasseler CMS 1.3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) do, (2) id, and (3) uname parameters. | 4.3 |
2009-06-26 | CVE-2009-2229 | Path Traversal vulnerability in Kasseler-Cms Kasseler CMS 1.3.5 Directory traversal vulnerability in engine.php in Kasseler CMS 1.3.5 lite allows remote attackers to read arbitrary files via a .. | 5.0 |
2009-06-26 | CVE-2009-2228 | Cross-Site Scripting vulnerability in Kasseler-Cms Kasseler CMS Cross-site scripting (XSS) vulnerability in engine.php in Kasseler CMS allows remote attackers to inject arbitrary web script or HTML via the url parameter in a redirect action. | 4.3 |
2008-09-30 | CVE-2008-4356 | SQL Injection vulnerability in Kasseler-Cms Kasseler CMS 1.1.0/1.2.0 Multiple SQL injection vulnerabilities in Kasseler CMS 1.1.0 and 1.2.0 allow remote attackers to execute arbitrary SQL commands via (1) the nid parameter to index.php in a View action to the News module; (2) the vid parameter to index.php in a Result action to the Voting module; (3) the fid parameter to index.php in a ShowForum action to the Forum module; (4) the tid parameter to index.php in a ShowTopic action to the Forum module; (5) the uname parameter to index.php in a UserInfo action to the Account module; or (6) the module parameter to index.php, probably related to the TopSites module. | 7.5 |
2008-07-09 | CVE-2008-3088 | Cross-Site Scripting vulnerability in Kasseler-Cms Kasseler CMS 1.3.0/1.3.1 Cross-site scripting (XSS) vulnerability in the Files module in Kasseler CMS 1.3.0 and 1.3.1 Lite allows remote attackers to inject arbitrary web script or HTML via the cid parameter in a Category action to index.php. | 4.3 |
2008-07-09 | CVE-2008-3087 | Path Traversal vulnerability in Kasseler-Cms Kasseler CMS 1.3.0 Directory traversal vulnerability in Kasseler CMS 1.3.0 allows remote attackers to read arbitrary files via a .. | 5.0 |