bg5sbk/MiniCMS

GitHub

github.com

1234n.com

Releases12

Frequency8 months 1 week

Last Release almost 5 years ago

Stars227

至简的个人网站内容管理系统

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2024-9282 ↗	Sep 27, 2024Friday, 27 September 2024, 13:15	4.3 MEDIUM	5 MEDIUM
A vulnerability was found in bg5sbk MiniCMS 1.11. It has been classified as problematic. Affected is an unknown function of the file page-edit.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions confusing version and file name information. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-9281 ↗	Sep 27, 2024Friday, 27 September 2024, 13:15	4.3 MEDIUM	5 MEDIUM
A vulnerability was found in bg5sbk MiniCMS up to 1.11 and classified as problematic. This issue affects some unknown processing of the file post-edit.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory mentions confusing version and file name information. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-31741 ↗	Apr 26, 2024Friday, 26 April 2024, 22:15	6.1 MEDIUM	—
Cross Site Scripting vulnerability in MiniCMS v.1.11 allows a remote attacker to run arbitrary code via crafted string in the URL after login.
CVE-2021-33387 ↗	Feb 24, 2023Friday, 24 February 2023, 16:15	9.6 CRITICAL	—
Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request.
CVE-2020-19896 ↗	Jun 28, 2022Tuesday, 28 June 2022, 22:15	9.8 CRITICAL	7.5 HIGH
File inclusion vulnerability in Minicms v1.9 allows remote attackers to execute arbitary PHP code via post-edit.php.
CVE-2022-33121 ↗	Jun 24, 2022Friday, 24 June 2022, 21:15	8.1 HIGH	5.8 MEDIUM
A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious link.
CVE-2021-41663 ↗	Jun 13, 2022Monday, 13 June 2022, 18:15	6.1 MEDIUM	4.3 MEDIUM
A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11. The vulnerability exists in the article upload: post-edit.php page.
CVE-2021-44970 ↗	Feb 10, 2022Thursday, 10 February 2022, 23:15	5.4 MEDIUM	3.5 LOW
MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.
CVE-2020-17999 ↗	Apr 28, 2021Wednesday, 28 April 2021, 16:15	6.1 MEDIUM	4.3 MEDIUM
Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP request to the component "/mc-admin/post-edit.php".
CVE-2020-36052 ↗	Jan 5, 2021Tuesday, 5 January 2021, 22:15	9.8 CRITICAL	7.5 HIGH
Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote attackers to include and execute arbitrary files via the state parameter.
CVE-2020-36051 ↗	Jan 5, 2021Tuesday, 5 January 2021, 22:15	7.5 HIGH	5 MEDIUM
Directory traversal vulnerability in page_edit.php in MiniCMS V1.10 allows remote attackers to read arbitrary files via the state parameter.
CVE-2019-13340 ↗	Jul 5, 2019Friday, 5 July 2019, 15:16	—	3.5 LOW
In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the content box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, CVE-2018-20520, and CVE-2019-13186.
CVE-2019-13341 ↗	Jul 5, 2019Friday, 5 July 2019, 15:16	—	3.5 LOW
In MiniCMS V1.10, stored XSS was found in mc-admin/conf.php (comment box), which can be used to get a user's cookie.
CVE-2019-13339 ↗	Jul 5, 2019Friday, 5 July 2019, 15:16	—	3.5 LOW
In MiniCMS V1.10, stored XSS was found in mc-admin/page-edit.php (content box), which can be used to get a user's cookie.
CVE-2019-13186 ↗	Jul 3, 2019Wednesday, 3 July 2019, 17:15	—	4.3 MEDIUM
In MiniCMS V1.10, stored XSS was found in mc-admin/post-edit.php via the tags box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296, CVE-2018-16233, and CVE-2018-20520.
CVE-2019-9603 ↗	Mar 6, 2019Wednesday, 6 March 2019, 19:29	—	5.8 MEDIUM
MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891.
CVE-2018-20520 ↗	Dec 27, 2018Thursday, 27 December 2018, 15:29	—	4.3 MEDIUM
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233.
CVE-2018-17039 ↗	Sep 14, 2018Friday, 14 September 2018, 07:29	—	4.3 MEDIUM
MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $_SERVER['REQUEST_URI'] is mishandled.
CVE-2018-17026 ↗	Sep 13, 2018Thursday, 13 September 2018, 20:29	—	3.5 LOW
admin/index.php in Monstra CMS 3.0.4 allows XSS via the page_meta_title parameter in an edit_page&name=error404 action, a different vulnerability than CVE-2018-10121.
CVE-2018-16298 ↗	Aug 31, 2018Friday, 31 August 2018, 23:29	—	4.3 MEDIUM
An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request.
CVE-2018-16233 ↗	Aug 30, 2018Thursday, 30 August 2018, 22:29	—	4.3 MEDIUM
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.
CVE-2018-15899 ↗	Aug 27, 2018Monday, 27 August 2018, 04:29	—	4.3 MEDIUM
An issue was discovered in MiniCMS 1.10. There is a post.php?date= XSS vulnerability.
CVE-2018-1000638 ↗	Aug 20, 2018Monday, 20 August 2018, 19:31	—	4.3 MEDIUM
MiniCMS version 1.1 contains a Cross Site Scripting (XSS) vulnerability in http://example.org/mc-admin/page.php?date={payload} that can result in code injection.
CVE-2018-10424 ↗	Apr 26, 2018Thursday, 26 April 2018, 05:29	—	4 MEDIUM
mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field.
CVE-2018-10423 ↗	Apr 26, 2018Thursday, 26 April 2018, 05:29	—	4 MEDIUM
mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a link that becomes available after posting an article.
CVE-2018-10296 ↗	Apr 22, 2018Sunday, 22 April 2018, 14:29	—	4.3 MEDIUM
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php title parameter.
CVE-2018-10227 ↗	Apr 19, 2018Thursday, 19 April 2018, 08:29	—	3.5 LOW
MiniCMS v1.10 has XSS via the mc-admin/conf.php site_link parameter.
CVE-2018-9092 ↗	Mar 27, 2018Tuesday, 27 March 2018, 22:29	—	6.8 MEDIUM
There is a CSRF vulnerability in mc-admin/conf.php in MiniCMS 1.10 that can change the administrator account password.