auracms/AuraCMS

auracms/AuraCMS

Releases0

Stars1

Indonesia Content Management System

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2018-16338 ↗	Sep 2, 2018Sunday, 2 September 2018, 18:29	—	6.8 MEDIUM
An issue was discovered in AuraCMS 2.3. There is a CSRF vulnerability that can change the administrator's password via admin.php?mod=users and subsequently add a page or menu, or submit a topic.
CVE-2018-15199 ↗	Aug 8, 2018Wednesday, 8 August 2018, 03:29	—	3.5 LOW
AuraCMS 2.3 allows XSS via a Bukutamu -> AddGuestbook action.
CVE-2014-1401 ↗	Feb 11, 2014Tuesday, 11 February 2014, 17:55	—	6.5 MEDIUM
Multiple SQL injection vulnerabilities in AuraCMS 2.3 and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) search parameter to mod/content/content.php or (2) CLIENT_IP, (3) X_FORWARDED_FOR, (4) X_FORWARDED, (5) FORWARDED_FOR, or (6) FORWARDED HTTP header to index.php.