758 matches found
CVE-2018-18774: Improper Neutralization of Input During Web Page Generation
CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter...
CVE-2018-18772: Cross-Site Request Forgery (CSRF)
CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=sendssh, as demonstrated by executing an arbitrary OS command...
CVE-2018-19291: Cross-Site Request Forgery (CSRF)
An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI...
PT-2018-14909
Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A CSRF issue allows deletion of a user or group via specific URIs, such as "admin/index.php/user/del/1" or "admin/index.php/role/del/2". Recommendations For DiliCMS version 2.4.0, as a temporary workaround,...
CVE-2018-19192
An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the datacontent parameter...
PT-2018-14857
Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue was discovered that allows arbitrary directory deletion via directory traversal in the admin/index.php endpoint, specifically through the paths variable. This is possible due to a lack of proper...
PT-2018-14856
Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue allows remote attackers to execute arbitrary code by bypassing restrictions on uploaded file types, such as jpg, jpeg, bmp, png, and gif, using the type parameter. This can be demonstrated by...
PT-2018-14854
Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue in XiaoCms allows full path disclosure through the "/admin/index.php?c=database" API endpoint, which returns a "failed to open stream" error message. Recommendations For XiaoCms version 20141229,...
PT-2018-14852
Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue was discovered in XiaoCms, where the API endpoint "admin/index.php?c=content&a=add&catid=3" is vulnerable to CSRF attacks. This can be exploited by entering news via the datacontent parameter...
CVE-2018-19194: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in XiaoCms 20141229. /admin/index.php?c=database allows full path disclosure in a "failed to open stream" error message...
CVE-2018-19192: Cross-Site Request Forgery (CSRF)
An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the datacontent parameter...
CVE-2018-19051
MetInfo 6.1.3 is affected by a cross-site scripting (XSS) vulnerability exploitable through the admin/index.php?a=dogetpassword abt_type parameter. The issue is tied to MetInfo’s admin input handling, enabling XSS in the context of the injected parameter. Connected sources consistently reference ...
CVE-2018-19051: Improper Neutralization of Input During Web Page Generation
MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abttype parameter...
PT-2018-14768
Name of the Vulnerable Software and Affected Versions MetInfo version 6.1.3 Description The issue is related to a Cross-Site Scripting XSS problem. It occurs via the langset parameter in the "admin/index.php?a=dogetpassword" endpoint. Recommendations For MetInfo version 6.1.3, update the software...
PT-2018-14769
Name of the Vulnerable Software and Affected Versions MetInfo version 6.1.3 Description The issue is related to a security problem where an attacker can inject malicious code. The problem is exploited through the abt type parameter in the "admin/index.php?a=dogetpassword" endpoint. Recommendation...
CVE-2018-19050: Improper Neutralization of Input During Web Page Generation
MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter...
CVE-2018-18694: Improper Neutralization of Input During Web Page Generation
admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases...
PT-2018-14575
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns stored XSS that can be triggered by remote authenticated administrators. This occurs when a file without an extension is uploaded, and in certain cases, this file is interpreted as...
CVE-2018-18626: Undefined Security Weakness
An issue was discovered in PHPYun V4.6. There is a vulnerability that can delete any file or directory via the "admin/index.php?m=database&c=del" sql parameter because delaction in admin/model/database.class.php mishandles this parameter...