Vulnerabilities
6 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-40889 | CMSUno version 1.7.2 is affected by a PHP code execution vulnerability. CMSUno version 1.7.2 is affected by a PHP code execution vulnerability. sauvePass action in {webroot}/uno/central.php file calls to file_put_contents() function to write username in password.php file when a user successfully changed their password. The attacker can inject malicious PHP code into password.php and then use the login function to execute code. NVD description · AI analysis pending | 9.8 | 2% | PoC |
| — | |
| CVE-2021-36654 | CMSuno 1.7 is vulnerable to an authenticated stored cross site scripting in modifying the filename parameter (tgo) while updating the theme. CMSuno 1.7 is vulnerable to an authenticated stored cross site scripting in modifying the filename parameter (tgo) while updating the theme. NVD description · AI analysis pending | 5.4 | 2% | PoC ×2 |
| — | |
| CVE-2020-25557 +1 in the same advisory: …25538 | In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username & password. In CMSuno 1.6.2, an attacker can inject malicious PHP code as a "username" while changing his/her username & password. After that, when attacker logs in to the application, attacker's code will be run. As a result of this vulnerability, authenticated user can run command on the server. NVD description · AI analysis pending | 8.8 | 10% | PoC ×2 |
| — | |
| CVE-2020-15600 | An issue was discovered in CMSUno before 1.6.1. An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password. NVD description · AI analysis pending | 6.5 | 2% | PoC ×2 |
| — | |
| CVE-2018-15567 | CMSUno before 1.5.3 has XSS via the title field. CMSUno before 1.5.3 has XSS via the title field. NVD description · AI analysis pending | 6.1 | <1% |
| — |