CVE-2018-10430

An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...

CVE-2018-10430: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...

PT-2018-9882

Name of the Vulnerable Software and Affected Versions: DiliCMS version 2.4.0 Description: A Stored XSS issue was found in the fourth textbox of "System setting-site setting" in admin/index.php, allowing for potential exploitation. Recommendations: For DiliCMS version 2.4.0, consider restricting...

Cross site request forgery (csrf)

An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI...

PT-2018-9795

Name of the Vulnerable Software and Affected Versions: HongCMS version 3.0.0 Description: An issue was discovered that allows for a CSRF vulnerability, enabling the addition of an administrator account via the "admin/index.php/users/save" URI. Recommendations: For HongCMS version 3.0.0, update to...

CVE-2018-10265: Cross-Site Request Forgery (CSRF)

An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI...

Cross site scripting

Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php...

CVE-2018-10118

Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php...

CVE-2018-10118

Monstra CMS 3.0.4 is affected by a Stored XSS in the Name field on the Create New Page screen (admin/index.php?id=pages), related to plugins/box/pages/pages.admin.php. This CVE details the vulnerable component path and the input point that leads to script execution. The connected data confirms th...

CVE-2018-10118: Improper Neutralization of Input During Web Page Generation

Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php...

PT-2018-9692

Name of the Vulnerable Software and Affected Versions: Monstra CMS version 3.0.4 Description: The issue is related to a Stored XSS in the Name field on the Create New Page screen, accessible under the "admin/index.php?id=pages" URI, and is associated with the plugins/box/pages/pages.admin.php fil...

PT-2018-9693

Name of the Vulnerable Software and Affected Versions: Monstra CMS version 3.0.4 Description: The issue concerns a stored XSS vulnerability. An attacker with access to the editor role can exploit this by entering a malicious payload in the title section of the "Edit 404 page" action, which is...

afmec.org XSS vulnerability

Open Bug Bounty ID: OBB-600205 Description| Value ---|--- Affected Website:| afmec.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

PT-2018-18800

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue allows remote attackers to delete files. This can be achieved by sending a request to the "admin/index.php" endpoint with specific parameters, including id set to "filesmanager", delete dir set t...

CVE-2018-6550

Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...

Design/Logic Flaw

Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...

CVE-2018-6550: Improper Neutralization of Input During Web Page Generation

Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...

PT-2018-17629

Name of the Vulnerable Software and Affected Versions Monstra CMS versions prior to 3.0.5 Description The issue concerns a problem with the title function in the pages.plugin.php file within the plugins/box/pages directory. This problem allows for XSS attacks when a page title is sent to...

CVE-2017-17645

Bus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php...

CVE-2017-17645

CVE-2017-17645 affects Bus Booking Script 1.0. The vulnerability is a SQL Injection via the txtname parameter in admin/index.php, caused by unsanitized input in a PHP/MySQL-based web app. Public references (NVD, CNVD, CVE records) describe SQL injection as the issue, with in-the-wild PoCs/exploit...