ProcessWire Cross Site Request Forgery vulnerability
Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to execute arbitrary code via a crafted HTML file to the comments functionality.
Advisories for Composer/Processwire/Processwire package
2024
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
An issue found in Processwire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameter when installing a new module.
2022
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via injection of a crafted payload.
Cross-Site Request Forgery (CSRF)
ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF).