boiteasite/cmsuno
GitHub
Releases51
Frequency2 months 4 days
Last Release
Stars28
An easy and clever tool to create one-page responsive websites
CVE History
| CVE | Published | CVSS v3 | CVSS v2 |
|---|---|---|---|
| 9.8 CRITICAL | 7.5 HIGH | ||
CMSUno version 1.7.2 is affected by a PHP code execution vulnerability. sauvePass action in {webroot}/uno/central.php file calls to file_put_contents() function to write username in password.php file when a user successfully changed their password. The attacker can inject malicious PHP code into password.php and then use the login function to execute code. | |||
| 5.4 MEDIUM | 3.5 LOW | ||
CMSuno 1.7 is vulnerable to an authenticated stored cross site scripting in modifying the filename parameter (tgo) while updating the theme. | |||
| 6.5 MEDIUM | 4.3 MEDIUM | ||
An issue was discovered in CMSUno before 1.6.1. uno.php allows CSRF to change the admin password. | |||
| — | 4.3 MEDIUM | ||
CMSUno before 1.5.3 has XSS via the title field. | |||