CVE-2019-8440

An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox aka site logo of "System setting-site setting" of admin/index.php, aka sitelogo...

CVE-2019-8439: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the second textbox of "System setting-site setting" of admin/index.php, aka sitedomain...

PT-2019-19038

Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A Stored XSS issue was found in the first textbox of "System setting-site setting" in admin/index.php, specifically affecting the site name variable. Recommendations For DiliCMS version 2.4.0, as a temporary...

CVE-2019-8438: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the first textbox of "System setting-site setting" of admin/index.php, aka sitename...

CVE-2019-8440: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox aka site logo of "System setting-site setting" of admin/index.php, aka sitelogo...

PT-2019-19039

Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A Stored XSS issue was found in the second textbox of "System setting-site setting" in admin/index.php, specifically related to the site domain. Recommendations For DiliCMS version 2.4.0, at the moment, there ...

CVE-2019-8407

HongCMS 3.0.0 is affected by CVE-2019-8407 due to a path traversal in the filename parameter of admin/index.php/language/edit, allowing arbitrary file read and write. The underlying cause is improper handling of "../" in the filename, enabling access to sensitive files. Impact: partial confidenti...

PT-2019-19015

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue allows for arbitrary file read and write operations. This is achieved by utilizing a ../ in the filename parameter to the "admin/index.php/language/edit" API endpoint. Recommendations For HongCMS...

CVE-2019-8407: Improper Limitation of a Pathname to a Restricted Directory

HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI...

CVE-2019-7718: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=...

PT-2019-18720

Name of the Vulnerable Software and Affected Versions Metinfo versions 6.x Description An issue was discovered that allows an attacker to execute arbitrary PHP code via a race condition in the backend database backup function. This can be achieved by leveraging the admin/index.php and...

PT-2019-17967

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue in XiaoCms allows SQL injection via the "table" parameter in the admin/index.php endpoint, specifically "/admin/index.php?c=database table". This can lead to PHP code execution by using "INTO...

CVE-2019-6127: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in XiaoCms 20141229. It allows admin/index.php?c=database table SQL injection. This can be used for PHP code execution via "INTO OUTFILE" with a .php filename...

CVE-2018-19556: Improper Input Validation

zbsystem/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing. NOTE: the software maintainer disputes that this is a vulnerability...

CVE-2018-19463: Improper Control of Generation of Code

zbsystem/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zbsystem/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can run PHP b...

CVE-2018-18774

CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter...

CVE-2018-18774: Improper Neutralization of Input During Web Page Generation

CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter...

CVE-2018-18772: Cross-Site Request Forgery (CSRF)

CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=sendssh, as demonstrated by executing an arbitrary OS command...

CVE-2018-18773: Cross-Site Request Forgery (CSRF)

CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password...

PT-2018-14909

Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A CSRF issue allows deletion of a user or group via specific URIs, such as "admin/index.php/user/del/1" or "admin/index.php/role/del/2". Recommendations For DiliCMS version 2.4.0, as a temporary workaround,...