Vastzero

A problematic issue has been found in iteachyou Dreamer CMS, affecting some unknown processing of the file /resource/js/ueditor-1.4.3.3. The manipulation leads to path traversal. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in iteachyou Dreamer CMS, affecting unknown code of the file /admin/archives/edit. The manipulation of the `editorValue/answer/content` argument leads to cross-site scripting. The attack can be initiated remotely.

A problematic issue has been found, affecting some unknown functionality and leading to cross-site request forgery. The attack can be launched remotely and multiple endpoints are affected.

A problematic issue was found in the CORS Handler component, leading to a permissive cross-domain policy with untrusted domains. The attack can be launched remotely, but the complexity is rather high and the exploitation appears to be difficult. The issue has been publicly disclosed and the vendor was contacted but did not respond.

A problematic issue has been found in the Exam Edit Handler component. The manipulation of the `title` and `content` arguments in the "/api/admin/question/edit" API endpoint leads to cross-site scripting. This issue can be exploited remotely. The vendor was contacted about this disclosure but did not respond.

A problematic vulnerability has been found in the langhsu Mblog Blog System. The issue affects an unknown function of the file `/login`, leading to an observable response discrepancy. This can be exploited remotely, but the complexity of the attack is rather high, and the exploitability is difficult. The exploit has been disclosed to the public.

A problematic vulnerability was found in the Search Bar component of the langhsu Mblog Blog System, affecting an unknown functionality of the file /search. The manipulation of the `kw` argument leads to cross-site scripting. This issue can be exploited remotely. The exploit has been publicly disclosed, and the vendor was contacted but did not respond.

A problematic vulnerability has been found in the component Article Content Editor, specifically in an unknown function of the file /admin/content/editor. This manipulation leads to cross site scripting and can be launched remotely. The exploit has been disclosed to the public and may be used.

A problematic issue has been found in the Article Editor component, specifically in the /admin/content/editor file, affecting an unknown functionality. The manipulation of the `articleCover` argument leads to server-side request forgery. This issue can be exploited remotely. The exploit has been disclosed to the public and may be used.

A problematic issue was found in the Edit Book Handler component, affecting an unknown function of the file /admin/content/book. This leads to server-side request forgery, which can be launched remotely. The exploit has been disclosed to the public and may be used.

A problematic issue has been found in Antabot White-Jotter, affecting some unknown processing of the file "/login". The manipulation of the argument `username` leads to observable response discrepancy. The attack may be initiated remotely. The complexity of an attack is rather high, and the exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

A vulnerability has been found in the Project Tasks Section component, affecting an unknown part of the file /project/050-9000000000000001/tasks. The manipulation of the `description` argument leads to cross-site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in the Admin Verification Page of the affected software, specifically in the file /user/admin-verify. The issue is related to the manipulation of the `nexturl` argument, which can lead to an open redirect when an input like `http://localhost/evil.html` is used. This can be initiated remotely. The exploit has been publicly disclosed, and the vendor was contacted but did not respond.

A problematic issue was found in the Login component, affecting unknown code of the file /mee/login. The manipulation of the `username` argument leads to an observable response discrepancy. The attack can be initiated remotely, with a rather high complexity of attack and difficult exploitation. The issue has been disclosed to the public.

A problematic issue was found in the Task Comment Attachment Upload component, affecting an unknown function. This issue leads to cross site scripting and can be exploited remotely. The exploit has been publicly disclosed, and the vendor was contacted about this issue but did not respond.

A problematic issue has been found in the Project Task Comment Handler component, leading to cross-site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted about this disclosure but did not respond.

A problematic vulnerability has been found in Dromara UJCMS, affecting an unknown part of the file `/users/id` of the component User ID Handler. The manipulation leads to authorization bypass. It is possible to initiate the attack remotely. The complexity of an attack is rather high, and the exploitability is told to be difficult.