PT-2020-16879

Name of the Vulnerable Software and Affected Versions SourceCodester Car Rental Management System version 1.0 Description The issue allows remote code execution due to an arbitrary file upload vulnerability in the Upload Image component. This is possible because .php files can be uploaded to the...

CVE-2020-23839

A Reflected Cross-Site Scripting XSS vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the logi...

CVE-2020-23839: Improper Neutralization of Input During Web Page Generation

A Reflected Cross-Site Scripting XSS vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the logi...

Cross site request forgery (csrf)

clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...

CVE-2020-13155

CVE-2020-13155 concerns a CSRF vulnerability in the NukeViet 4.4 product, where the request to CSRF via clearsystem.php can inject HTML when the deltype parameter is used in the URI admin/index.php?nv=webtools&op=clearsystem. The affected component is the clearsystem functionality in NukeViet 4.4...

CVE-2020-13155

clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...

CVE-2020-13155: Cross-Site Request Forgery (CSRF)

clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...

PT-2020-13362

Name of the Vulnerable Software and Affected Versions NukeViet version 4.4 Description The issue allows for a Cross-Site Request Forgery CSRF attack to change a user's password without needing the old password. This is achieved through the admin/index.php?nv=users&op=edit&userid= URI in the...

CVE-2020-13156: Cross-Site Request Forgery (CSRF)

modules\users\admin\adduser.php in NukeViet 4.4 allows CSRF to add a user account via the admin/index.php?nv=users&op=useradd URI...

PT-2020-13360

Name of the Vulnerable Software and Affected Versions NukeViet version 4.4 Description The issue allows for CSRF with resultant HTML injection via the deltype parameter to the "admin/index.php?nv=webtools&op=clearsystem" URI. This can be exploited through the clearsystem.php file. Recommendations...

CVE-2020-13978: Improper Neutralization of Special Elements used in an OS Command

Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commands via the Theme Module by visiting the admin/index.php?id=themes&action=editchunk URI. NOTE: there is no indication that the Edit Chunk...

CVE-2020-13384

Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048...

PT-2020-13509

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue allows remote authenticated users to upload and execute arbitrary PHP code. This is possible because the system blocks .php filenames but does not block filenames with certain extensions such as...

CVE-2020-13384: Unrestricted Upload of File with Dangerous Type

Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048...

PT-2020-12683

Name of the Vulnerable Software and Affected Versions Search Meter plugin versions through 2.13.2 Description The issue allows user input introduced in the search bar to be any formula, potentially leading to remote code execution via CSV injection if a specific export is performed, specifically...

CVE-2020-10415

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/index.php by adding a question mark ? followed by the payload...

CVE-2020-10415

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/index.php by adding a question mark ? followed by the payload...

CVE-2020-10415: Improper Neutralization of Input During Web Page Generation

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/index.php by adding a question mark ? followed by the payload...

PT-2020-8647

Name of the Vulnerable Software and Affected Versions: Monstra CMS version 1.6 Description: The issue allows for XSS via an uploaded SVG document to the "admin/index.php?id=filesmanager&path=uploads/" URI. It is noted that Monstra CMS is a discontinued product. Recommendations: For Monstra CMS...

CVE-2018-19599: Improper Neutralization of Input During Web Page Generation

Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product...