noneCms

noneCms copied to clipboard

安装1.0 提示写入临时文件失败

my-dollar1

NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected arbitrary web script or HTML via the name parameter to launch...

ghost

NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/role/dele.html, as demonstrated by deleting the admin role. Vulnerability code is located in application\admin\controller\Role.php: ```php /** * 删除角色信息 */ public function dele() {...

ghost

The latest patch V1.3.0 of NoneCMS has a directory traversal vulnerability in application/admin/controller/Main.php. The vulnerability allows remote authenticated users to delete arbitrary files by leveraging back-office access to provide a...

ghost

Cross-site scripting (XSS) vulnerability in admin/article/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter. By default, noneCMS uses Editor.md for...

ghost

Cross-site scripting (XSS) vulnerability in admin/nav/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter. A remote user who has the...

ghost

NoneCMS V1.3.0 has a XSS vulnerability in static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf. I download the swfupload.swf file and I use FFdec to decompile the file. Then I find that user can control the movieName...

ghost

install的时候，执行的数据库文件少了chat_record 和room表，导致聊天室无法发送

donghuiing

由于在根据源码的加密过程更改了数据库中的password字段的值,未进行记录，因此无法复现（重新安装可复现 在更改之前，一直用户密码错误，更改之后，好了 不知道是不是测试数据的问题还是设置的用户名、密码未进入数据库 测试账户： 账号：admin 密码：admin123   更改数据库数据后成功d登录！ 

qian-xiang

两种文本编辑器

1

两种文本编辑器保存的文章前台把html代码展示了出来

varphper