Filtered by vendor Wondercms
Subscriptions
Filtered by product Wondercms
Subscriptions
Total
36 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-3123 | 1 Wondercms | 1 Wondercms | 2025-05-28 | 4.7 Medium |
| A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0. Affected by this issue is the function installUpdateModuleAction of the component Theme Installation/Plugin Installation. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains, that "[t]he philosophy has always been, admin [...] bear responsibility to not install themes/plugins from untrusted sources." | ||||
| CVE-2022-43332 | 1 Wondercms | 1 Wondercms | 2025-04-29 | 6.1 Medium |
| A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Site title field of the Configuration Panel. | ||||
| CVE-2023-41425 | 1 Wondercms | 1 Wondercms | 2025-04-24 | 6.1 Medium |
| Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. | ||||
| CVE-2017-7951 | 1 Wondercms | 1 Wondercms | 2025-04-20 | N/A |
| WonderCMS before 2.0.3 has CSRF because of lack of a token in an unspecified context. | ||||
| CVE-2014-8703 | 1 Wondercms | 1 Wondercms | 2025-04-20 | N/A |
| Cross-site scripting (XSS) vulnerability in Wonder CMS 2014 allows remote attackers to inject arbitrary web script or HTML. | ||||
| CVE-2014-8704 | 1 Wondercms | 1 Wondercms | 2025-04-20 | N/A |
| Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme. | ||||
| CVE-2014-8705 | 1 Wondercms | 1 Wondercms | 2025-04-20 | N/A |
| PHP remote file inclusion vulnerability in editInplace.php in Wonder CMS 2014 allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter. | ||||
| CVE-2014-8702 | 1 Wondercms | 1 Wondercms | 2025-04-20 | N/A |
| Wonder CMS 2014 allows remote attackers to obtain sensitive information by logging into the application with an array for the password, which reveals the installation path in an error message. | ||||
| CVE-2014-8701 | 1 Wondercms | 1 Wondercms | 2025-04-20 | N/A |
| Wonder CMS 2014 allows remote attackers to obtain sensitive information by viewing /files/password, which reveals the unsalted MD5 hashed password. | ||||
| CVE-2011-5317 | 1 Wondercms | 1 Wondercms | 2025-04-12 | N/A |
| Cross-site scripting (XSS) vulnerability in editText.php in WonderCMS before 0.4 allows remote attackers to inject arbitrary web script or HTML via the content parameter. | ||||
| CVE-2024-41304 | 1 Wondercms | 1 Wondercms | 2025-04-11 | 5.4 Medium |
| An arbitrary file upload vulnerability in the uploadFileAction() function of WonderCMS v3.4.3 allows attackers to execute arbitrary code via a crafted SVG file. | ||||
| CVE-2024-32337 | 1 Wondercms | 1 Wondercms | 2025-04-11 | 6.1 Medium |
| A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ADMIN LOGIN URL parameter under the Security module. | ||||
| CVE-2024-32338 | 1 Wondercms | 1 Wondercms | 2025-04-11 | 5.4 Medium |
| A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE TITLE parameter under the Current Page module. | ||||
| CVE-2024-32339 | 1 Wondercms | 1 Wondercms | 2025-04-11 | 6.1 Medium |
| Multiple cross-site scripting (XSS) vulnerabilities in the HOW TO page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into any of the parameters. | ||||
| CVE-2024-32340 | 1 Wondercms | 1 Wondercms | 2025-04-11 | 9.6 Critical |
| A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the WEBSITE TITLE parameter under the Menu module. | ||||
| CVE-2024-32341 | 1 Wondercms | 1 Wondercms | 2025-04-11 | 5.4 Medium |
| Multiple cross-site scripting (XSS) vulnerabilities in the Home page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into any of the parameters. | ||||
| CVE-2024-32743 | 1 Wondercms | 1 Wondercms | 2025-04-11 | 5.5 Medium |
| A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the SITE LANGUAGE CONFIG parameter under the Security module. | ||||
| CVE-2024-32744 | 1 Wondercms | 1 Wondercms | 2025-04-11 | 4.6 Medium |
| A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE KEYWORDS parameter under the CURRENT PAGE module. | ||||
| CVE-2024-32745 | 1 Wondercms | 1 Wondercms | 2025-04-11 | 5.9 Medium |
| A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the PAGE DESCRIPTION parameter under the CURRENT PAGE module. | ||||
| CVE-2024-32746 | 1 Wondercms | 1 Wondercms | 2025-04-11 | 4.6 Medium |
| A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the MENU parameter under the Menu module. | ||||