755 matches found
PT-2022-18426
Name of the Vulnerable Software and Affected Versions Ecommerce-Website version 1.1.0 Description The issue allows attackers to upload a webshell via the Product Image component due to an unrestricted file upload at the "/public/admin/index.php?add product" API endpoint. Recommendations For...
CVE-2022-27436: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in /public/admin/index.php?adduser at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username text field...
CVE-2021-44610
Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 URLs, 2 langid, 3 tmplid, 4 modrewrite 5 etadoctype. 6 metacharset, 7 defaultgroup, and 8 page group parameters in the settings mode in admin/index.php...
Sql injection
Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 URLs, 2 langid, 3 tmplid, 4 modrewrite 5 etadoctype. 6 metacharset, 7 defaultgroup, and 8 page group parameters in the settings mode in admin/index.php...
CVE-2021-44610
Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 URLs, 2 langid, 3 tmplid, 4 modrewrite 5 etadoctype. 6 metacharset, 7 defaultgroup, and 8 page group parameters in the settings mode in admin/index.php...
PT-2022-12186
Name of the Vulnerable Software and Affected Versions bloofoxCMS versions 0.5.1 through 0.5.2.1 Description Multiple SQL Injection vulnerabilities exist in the software via the URLs, lang id, tmpl id, mod rewrite, eta doctype, meta charset, default group, and page group parameters in the settings...
CVE-2021-44610: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 URLs, 2 langid, 3 tmplid, 4 modrewrite 5 etadoctype. 6 metacharset, 7 defaultgroup, and 8 page group parameters in the settings mode in admin/index.php...
CVE-2020-20946
CVE-2020-20946 affects Qibosoft v7 (CMS) with a stored XSS vulnerability in the admin path /admin/index.php?lfj=friendlink&action=add. The root cause is input data not validated in the friendlink/add handler, enabling injected client-side script execution. CVSS metrics indicate a Low to Medium ov...
PT-2021-10557
Name of the Vulnerable Software and Affected Versions: Qibosoft version 7 Description: A Cross-Site Request Forgery CSRF issue exists in the /admin/index.php?lfj=member&action=editmember endpoint of Qibosoft, allowing attackers to add administrator accounts arbitrarily. Recommendations: For...
PT-2021-10558
Name of the Vulnerable Software and Affected Versions: Qibosoft version 7 Description: The issue is related to a stored cross-site scripting XSS vulnerability. It affects the /admin/index.php?lfj=friendlink&action=add endpoint. Recommendations: For Qibosoft version 7, update the software to a...
CVE-2020-20946: Improper Neutralization of Input During Web Page Generation
Qibosoft v7 contains a stored cross-site scripting XSS vulnerability in the component /admin/index.php?lfj=friendlink&action=add...
CVE-2020-20945: Cross-Site Request Forgery (CSRF)
A Cross-Site Request Forgery CSRF in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add administrator accounts...
CVE-2020-20944: Improper Limitation of a Pathname to a Restricted Directory
An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files...
CVE-2021-36548
A remote code execution RCE vulnerability in the component /admin/index.php?id=themes&action=edittemplate&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary commands via a crafted PHP file...
PT-2021-21286
Name of the Vulnerable Software and Affected Versions Monstra version 3.0.4 Description A remote code execution issue in the /admin/index.php?id=themes&action=edit template&filename=blog component allows attackers to execute arbitrary commands via a crafted PHP file. Recommendations For Monstra...
CVE-2021-36548: Unrestricted Upload of File with Dangerous Type
A remote code execution RCE vulnerability in the component /admin/index.php?id=themes&action=edittemplate&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary commands via a crafted PHP file...
CVE-2020-28145
Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitive information...
CVE-2020-28145: Exposure of Resource to Wrong Sphere
Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitive information...
PT-2021-10623
Name of the Vulnerable Software and Affected Versions: HongCMS version 3.0 Description: The issue concerns an arbitrary file read and write vulnerability. It is located in the component /admin/index.php/template/edit. Recommendations: For HongCMS version 3.0, consider restricting access to the...