CVE-2018-19291: Cross-Site Request Forgery (CSRF)

An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI...

CVE-2018-19192

An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the datacontent parameter...

PT-2018-14854

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue in XiaoCms allows full path disclosure through the "/admin/index.php?c=database" API endpoint, which returns a "failed to open stream" error message. Recommendations For XiaoCms version 20141229,...

PT-2018-14852

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue was discovered in XiaoCms, where the API endpoint "admin/index.php?c=content&a=add&catid=3" is vulnerable to CSRF attacks. This can be exploited by entering news via the datacontent parameter...

PT-2018-14856

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue allows remote attackers to execute arbitrary code by bypassing restrictions on uploaded file types, such as jpg, jpeg, bmp, png, and gif, using the type parameter. This can be demonstrated by...

PT-2018-14857

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue was discovered that allows arbitrary directory deletion via directory traversal in the admin/index.php endpoint, specifically through the paths variable. This is possible due to a lack of proper...

CVE-2018-19194: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in XiaoCms 20141229. /admin/index.php?c=database allows full path disclosure in a "failed to open stream" error message...

CVE-2018-19192: Cross-Site Request Forgery (CSRF)

An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the datacontent parameter...

CVE-2018-19051

MetInfo 6.1.3 is affected by a cross-site scripting (XSS) vulnerability exploitable through the admin/index.php?a=dogetpassword abt_type parameter. The issue is tied to MetInfo’s admin input handling, enabling XSS in the context of the injected parameter. Connected sources consistently reference ...

PT-2018-14768

Name of the Vulnerable Software and Affected Versions MetInfo version 6.1.3 Description The issue is related to a Cross-Site Scripting XSS problem. It occurs via the langset parameter in the "admin/index.php?a=dogetpassword" endpoint. Recommendations For MetInfo version 6.1.3, update the software...

PT-2018-14769

Name of the Vulnerable Software and Affected Versions MetInfo version 6.1.3 Description The issue is related to a security problem where an attacker can inject malicious code. The problem is exploited through the abt type parameter in the "admin/index.php?a=dogetpassword" endpoint. Recommendation...

CVE-2018-19051: Improper Neutralization of Input During Web Page Generation

MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abttype parameter...

CVE-2018-19050: Improper Neutralization of Input During Web Page Generation

MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter...

PT-2018-14575

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns stored XSS that can be triggered by remote authenticated administrators. This occurs when a file without an extension is uploaded, and in certain cases, this file is interpreted as...

CVE-2018-18694: Improper Neutralization of Input During Web Page Generation

admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases...

CVE-2018-18626: Undefined Security Weakness

An issue was discovered in PHPYun V4.6. There is a vulnerability that can delete any file or directory via the "admin/index.php?m=database&c=del" sql parameter because delaction in admin/model/database.class.php mishandles this parameter...

PT-2018-14421

Name of the Vulnerable Software and Affected Versions MetInfo version 6.1.2 Description A security issue exists in the admin/index.php page of the affected software, where an XSS attack can be performed via the anyid parameter in the page. Recommendations For MetInfo version 6.1.2, avoid using th...

CVE-2018-18374: Improper Neutralization of Input During Web Page Generation

XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter...

CVE-2018-18323

CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=fileeditor&file=/../ URI...

CVE-2018-18322

CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php servicestart, servicerestart, servicefullstatus, or servicestop parameter...