PT-2018-14396

Name of the Vulnerable Software and Affected Versions MetInfo version 6.1.2 Description The issue allows for XSS via the /admin/index.php endpoint with the bigclass parameter in an n=column&a=doadd action. This affects the bigclass parameter, which is used in the specified action. Recommendations...

CVE-2018-18296: Improper Neutralization of Input During Web Page Generation

MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action...

CVE-2018-18324: Improper Neutralization of Input During Web Page Generation

CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fmcurrentdir parameter, or the admin/index.php module, servicestart, servicefullstatus, servicerestart, servicestop, or file within the fileeditor parameter...

CVE-2018-18323: Improper Limitation of a Pathname to a Restricted Directory

CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=fileeditor&file=/../ URI...

CVE-2018-18322: Improper Neutralization of Special Elements used in an OS Command

CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php servicestart, servicerestart, servicefullstatus, or servicestop parameter...

CVE-2018-18209

XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenttype parameter...

CVE-2018-18210

XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenturl parameter...

PT-2018-14371

Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A security issue exists due to the presence of XSS in the attachment url parameter of the "admin/index.php/setting/site?tab=site attachment" endpoint. Recommendations For DiliCMS version 2.4.0, avoid using the...

PT-2018-14369

Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A security issue exists due to the presence of XSS in the attachment type parameter of the "admin/index.php/setting/site?tab=site attachment" endpoint. Recommendations For DiliCMS version 2.4.0, avoid using th...

CVE-2018-18209: Improper Neutralization of Input During Web Page Generation

XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenttype parameter...

CVE-2018-18210: Improper Neutralization of Input During Web Page Generation

XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenturl parameter...

PT-2018-14363

Name of the Vulnerable Software and Affected Versions qibosoft version 7.0 Description The issue allows for a CSRF attack, enabling an attacker to add a user account. This can be achieved through the "admin/index.php?lfj=member&action=addmember" API endpoint. Recommendations For qibosoft version...

CVE-2018-18201: Cross-Site Request Forgery (CSRF)

qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account...

CVE-2018-16819

admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&deletefile= requests...

CVE-2018-16820

admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests...

CVE-2018-16820

Monstra CMS 3.0.4 is affected by a directory-traversal in admin/index.php, exploitable via id=filesmanager&path=uploads/… requests to list arbitrary directories. Root cause is improper handling of the path parameter that enables traversal. Impact per NVD: High (CVSSv3 7.5) for confidentiality los...

PT-2018-13761

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue allows for arbitrary directory listing. This can be achieved by sending a request to the "admin/index.php" endpoint with specific parameters, such as id=filesmanager and...

CVE-2018-16819: Improper Limitation of a Pathname to a Restricted Directory

admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&deletefile= requests...

PT-2018-13760

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns arbitrary file deletion in Monstra CMS. An attacker can exploit this by sending a request to the "admin/index.php" endpoint with specific parameters, including id, path, and delete file...

CVE-2018-16820: Improper Limitation of a Pathname to a Restricted Directory

admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests...