Razorcms

15 CVEs across 1 Razorcms products. Browse Razorcms vulnerabilities, severities, and proof-of-concept exploits.

Razorcms products with known CVEs

ProductCVEs
Razorcms15
Razorcms CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2018-19906Medium5.42018-12-31Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.
CVE-2018-19905Medium5.42018-12-31HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.
CVE-2018-17986High8.82018-10-05rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user.
CVE-2018-16727Medium5.42018-09-12razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.
CVE-2018-16726Medium5.42018-09-12razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.
CVE-2012-60382012-11-26admin/core/admin_func.php in razorCMS before 1.2.1 does not properly restrict access to certain administrator directories and files, which allows remote authen…
CVE-2012-59182012-11-19razorCMS 1.2 allows remote authenticated users to access administrator directories and files by creating and deleting a directory.
CVE-2012-19002012-10-22Cross-site request forgery (CSRF) vulnerability in admin/index.php in RazorCMS 1.2.1 and earlier allows remote attackers to hijack the authentication of admini…
CVE-2010-50512011-11-23Cross-site scripting (XSS) vulnerability in admin/core/admin_func.php in razorCMS 1.0 stable allows remote attackers to inject arbitrary web script or HTML via…
CVE-2009-14632009-04-28Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving content as a .php file.
CVE-2009-14622009-04-28The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the docu…
CVE-2009-14612009-04-28Cross-site scripting (XSS) vulnerability in the Create New Page form in razorCMS 0.3 RC2 and earlier allows remote authenticated users to inject arbitrary web…
CVE-2009-14602009-04-28razorCMS before 0.4 uses weak permissions for (1) admin/core/admin_config.php, which allows local users to obtain the administrator's password hash and FTP use…
CVE-2009-14592009-04-28Cross-site request forgery (CSRF) vulnerability in razorCMS before 0.4 allows remote attackers to hijack the authentication of administrators for requests that…
CVE-2009-14582009-04-28Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in razorCMS before 0.4 allow remote attackers to inject arbitrary web script or HTML via…