Clippercms

10 CVEs across 1 Clippercms products. Browse Clippercms vulnerabilities, severities, and proof-of-concept exploits.

Clippercms products with known CVEs

ProductCVEs
Clippercms10
Clippercms CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2022-41497Critical9.82022-10-13ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the pkg_url parameter at /manager/index.php.
CVE-2022-41495Critical9.82022-10-13ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the rss_url_news parameter at /manager/index.php.
CVE-2018-12101Medium5.42019-08-15CMS Clipper 1.3.3 has XSS in the Security tab search, User Groups, Resource Groups, and User/Resource Group Links fields.
CVE-2018-19424High7.22018-11-21ClipperCMS 1.3.3 allows remote authenticated administrators to upload .htaccess files.
CVE-2018-19135High8.82018-11-11ClipperCMS 1.3.3 does not have CSRF protection on its kcfinder file upload (enabled by default). This can be used by an attacker to perform actions for an admi…
CVE-2018-13998Medium4.82018-07-12ClipperCMS 1.3.3 has stored XSS via the Full Name field of (1) Security -> Manager Users or (2) Security -> Web Users.
CVE-2018-13106Medium4.82018-07-03ClipperCMS 1.3.3 has stored XSS via the "Tools -> Configuration" screen of the manager/ URI.
CVE-2018-11572Medium5.42018-05-31ClipperCMS 1.3.3 has XSS in the "Module name" field in a "Modules -> Manage modules -> edit" action to the manager/ URI.
CVE-2018-11571High8.82018-05-31ClipperCMS 1.3.3 allows Session Fixation.
CVE-2018-11332Medium4.82018-05-24Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 allows remote attacke…