Skip to content
Noroxi

razorcms records

15 published records for vendor razorcms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

15 records
  • CVE-2018-17986
    35Monitor

    rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user.

    HighCVSS 8.8No exploitEPSS 0%

    razorcms · razorcmsOct 4, 2018

  • CVE-2009-1463
    30Monitor

    Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving cont

    HighCVSS 7.5No exploitEPSS 1%

    razorcms · razorcmsApr 28, 2009

  • CVE-2012-1900
    28Monitor

    Cross-site request forgery (CSRF) vulnerability in admin/index.php in RazorCMS 1.2.1 and earlier allows remote attackers to hijack the authe

    MediumCVSS 6.8Proof of conceptEPSS 2%

    razorcms · razorcmsOct 22, 2012

  • CVE-2009-1462
    28Monitor

    The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsi

    HighCVSS 7.2No exploitEPSS 0%

    razorcms · razorcmsApr 28, 2009

  • CVE-2012-6038
    27Monitor

    admin/core/admin_func.php in razorCMS before 1.2.1 does not properly restrict access to certain administrator directories and files, which a

    MediumCVSS 6.5Proof of conceptEPSS 2%

    razorcms · razorcmsNov 26, 2012

  • CVE-2009-1459
    27Monitor

    Cross-site request forgery (CSRF) vulnerability in razorCMS before 0.4 allows remote attackers to hijack the authentication of administrator

    MediumCVSS 6.8No exploitEPSS 0%

    razorcms · razorcmsApr 28, 2009

  • CVE-2018-19905
    21Monitor

    HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.

    MediumCVSS 5.4No exploitEPSS 0%

    razorcms · razorcmsDec 31, 2018

  • CVE-2018-19906
    21Monitor

    Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.

    MediumCVSS 5.4No exploitEPSS 0%

    razorcms · razorcmsDec 31, 2018

  • CVE-2018-16727
    21Monitor

    razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.

    MediumCVSS 5.4No exploitEPSS 0%

    razorcms · razorcmsSep 12, 2018

  • CVE-2018-16726
    21Monitor

    razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.

    MediumCVSS 5.4No exploitEPSS 0%

    razorcms · razorcmsSep 12, 2018

  • CVE-2009-1458
    18Monitor

    Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in razorCMS before 0.4 allow remote attackers to inject arbitrary web

    MediumCVSS 4.3Proof of conceptEPSS 1%

    razorcms · razorcmsApr 28, 2009

  • CVE-2009-1460
    18Monitor

    razorCMS before 0.4 uses weak permissions for (1) admin/core/admin_config.php, which allows local users to obtain the administrator's passwo

    MediumCVSS 4.6No exploitEPSS 0%

    razorcms · razorcmsApr 28, 2009

  • CVE-2010-5051
    17Monitor

    Cross-site scripting (XSS) vulnerability in admin/core/admin_func.php in razorCMS 1.0 stable allows remote attackers to inject arbitrary web

    MediumCVSS 4.3Proof of conceptEPSS 1%

    razorcms · razorcmsNov 22, 2011

  • CVE-2012-5918
    16Monitor

    razorCMS 1.2 allows remote authenticated users to access administrator directories and files by creating and deleting a directory.

    MediumCVSS 4.0Proof of conceptEPSS 1%

    razorcms · razorcmsNov 19, 2012

  • CVE-2009-1461
    14Monitor

    Cross-site scripting (XSS) vulnerability in the Create New Page form in razorCMS 0.3 RC2 and earlier allows remote authenticated users to in

    LowCVSS 3.5No exploitEPSS 0%

    razorcms · razorcmsApr 28, 2009