Robert Kruczek

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.

WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5.

Improper neutralization of user-provided input in parameters used for sorting functions allows an unauthenticated attacker to execute SQL Injection attacks. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

A reflected cross-site scripting (XSS) issue allows an attacker to execute arbitrary JavaScript in a user's browser by inducing them to open a specially crafted URL.

An authenticated SQL injection occurs due to improper neutralization of input provided by a user into parameters used for sorting functions. This allows an authenticated attacker to execute arbitrary SQL commands.

A Cross-Site Request Forgery (CSRF) issue exists due to the absence of CSRF tokens or appropriate SameSite attributes. This allows an attacker to send unauthorized requests using the session of an authenticated user, which can result in unauthorized administrative actions, including the creation of new admin accounts. CSRF is a technique where a malicious website causes a user's web browser to perform an unwanted action on a different website where the user is currently authenticated.

An authenticated attacker can perform SQL Injection attacks due to improper neutralization of user input sent to the 'pjAdminPolls.controller.php' endpoint. SQL Injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database.

A Remote Code Execution issue exists due to missing authentication for a critical file upload function. The application exposes an endpoint that allows unauthenticated attackers to upload arbitrary PHP files by providing a base64-encoded payload, enabling the execution of arbitrary code on the underlying server.

An unauthenticated attacker can upload files of any type and extension without restriction via the 'dialog.php' endpoint. This unrestricted file upload can lead to Remote Code Execution, which allows an attacker to execute arbitrary code on the server.

Privilege Escalation occurs due to excessive database privileges assigned to the application user. An attacker with access to a running application instance connected to the backend server can extract database credentials from the application's memory by inspecting the running process. These exposed credentials provide administrative access to the database, allowing actions that exceed the privileges required for normal application functionality and those permitted through the application interface.

mpGabinet performs client-side authentication, which is a process where the verification of user credentials happens on the user's device rather than the server. An attacker with access to any application instance connected to the backend server can bypass the login verification process by manipulating the application binary to authenticate as an arbitrary user.

Some increased actor activities are shown targeting BinSoft mpGabinet (CVE-2026-40552) https://t.co/mUbccZwq7B

The file upload functionality in PAD CMS allows an unauthenticated remote attacker to upload files of any type and extension without restriction. This is due to a client-controlled permission check parameter. Successful exploitation can lead to Remote Code Execution. The issue affects all three templates: www, bip, and ww+bip. The product is End-Of-Life and the producer will not publish patches for this vulnerability.

The software’s photo upload functionality allows a remote attacker to upload files of any type and extension without restriction due to a client-controlled permission check parameter. This can lead to Remote Code Execution. The issue affects all three templates: `www`, `bip`, and `ww+bip`. The product is End-Of-Life and the producer will not release patches for this issue.

The LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress is susceptible to Stored Cross-Site Scripting. The issue stems from inadequate input sanitization and output escaping in the `service[name]` parameter. This allows authenticated attackers with administrator-level access to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This only affects multi-site installations and installations where unfiltered html has been disabled.

The input from the search query parameter in GOV CMS is not properly sanitized, leading to a Blind SQL injection. This could be exploited by an unauthenticated remote attacker.

Name of the Vulnerable Software and Affected Versions: QuickCMS version 6.8 QuickCMS (affected versions not specified) Description: QuickCMS is vulnerable to Stored Cross-Site Scripting (XSS) in the `sTitle` parameter within the page editor functionality. A malicious attacker with admin privileges can inject arbitrary HTML and JavaScript into the website, which will be rendered and executed when visiting the edited page. A regular admin user is not able to inject any JavaScript scripts into the page. The vendor was notified about this issue but did not respond with details regarding vulnerable version ranges. Recommendations: QuickCMS version 6.8: As a temporary workaround, sanitize the `sTitle` input to prevent the injection of malicious HTML and JavaScript code. QuickCMS (affected versions not specified): As a temporary workaround, sanitize the `sTitle` input to prevent the injection of malicious HTML and JavaScript code.

Name of the Vulnerable Software and Affected Versions: QuickCMS version 6.8 QuickCMS (affected versions not specified) Description: QuickCMS is vulnerable to Cross-Site Request Forgery in the article creation functionality. A malicious attacker can craft a special website that, when visited by an administrator, will automatically send a POST request creating a malicious article with content defined by the attacker. The vendor was notified about this issue but did not respond with details or a vulnerable version range. Recommendations: QuickCMS version 6.8: Mitigate this issue by implementing CSRF tokens or other appropriate security measures to protect the article creation functionality. QuickCMS (affected versions not specified): Implement CSRF tokens or other appropriate security measures to protect the article creation functionality.

Name of the Vulnerable Software and Affected Versions: QuickCMS.EXT version 6.8 QuickCMS.EXT (affected versions not specified) Description: QuickCMS.EXT is susceptible to a Reflected Cross-Site Scripting (XSS) issue within the thumbnail viewer functionality. An attacker can create a malicious URL that, when opened, leads to the execution of arbitrary JavaScript code in the victim’s browser. The vulnerability resides in the `sFileName` parameter. Recommendations: QuickCMS.EXT version 6.8: Address the vulnerability by sanitizing or validating the `sFileName` parameter within the thumbnail viewer functionality to prevent the injection of malicious scripts. QuickCMS.EXT (affected versions not specified): Address the vulnerability by sanitizing or validating the `sFileName` parameter within the thumbnail viewer functionality to prevent the injection of malicious scripts.

Name of the Vulnerable Software and Affected Versions: Lepszy BIP (affected versions not specified) Description: Lepszy BIP is susceptible to a Reflected Cross-Site Scripting (XSS) issue. Insufficient input validation within the `index.php` form allows for the execution of arbitrary JavaScript code in a victim’s browser through a specially crafted URL. The vendor was contacted regarding this disclosure but did not respond. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.