CVE-2018-17024

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an addpage action...

CVE-2018-17025

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage action for a page with no special role...

CVE-2018-17024

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an addpage action...

CVE-2018-17025

CVE-2018-17025 affects Monstra CMS 3.0.4. The issue is an XSS in admin/index.php via the page_meta_title parameter in an edit_page action for pages with no special role. Documented impact is XSS; no exploitation details are provided in the sources. CVSS scores listed: CVSS v2 base 4.3 (Medium) an...

PT-2018-13845

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns an XSS exploit via the page meta title parameter in the add page action. This is related to the admin/index.php file in Monstra CMS. Recommendations For Monstra CMS version 3.0.4, avoid...

CVE-2018-17025: Improper Neutralization of Input During Web Page Generation

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage action for a page with no special role...

PT-2018-13846

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns an XSS exploit via the page meta title parameter in the admin/index.php file when performing an edit page action for a page without a special role. Recommendations For Monstra CMS versio...

PT-2018-13847

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns an XSS vulnerability. It can be exploited via the page meta title parameter in an "edit page&name=error404" action on the "admin/index.php" page. Recommendations For Monstra CMS version...

CVE-2018-17024: Improper Neutralization of Input During Web Page Generation

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an addpage action...

CVE-2018-17026: Improper Neutralization of Input During Web Page Generation

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage&name=error404 action, a different vulnerability than CVE-2018-10121...

Arbitrary file deletion

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete...

PT-2018-13738

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue allows for arbitrary file deletion. This can be achieved by manipulating the file parameter in the /admin/index.php/language/ajax endpoint with a ../ sequence and setting the action parameter to...

PT-2018-13270

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns the improper restriction of modified Snippet content. This is demonstrated through the "admin/index.php?id=snippets&action=edit snippet&filename=google-analytics" URI, which allows...

CVE-2018-16774: Improper Limitation of a Pathname to a Restricted Directory

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete...

CVE-2018-16608: Authorization Bypass Through User-Controlled Key

In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the administrator via an admin/index.php?id=users&action=edit&userid=1, Insecure Direct Object Reference IDOR...

PT-2018-13647

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue allows an attacker with 'Editor' privileges to change the administrator's password due to an Insecure Direct Object Reference IDOR vulnerability. This can be achieved by accessing the...

PT-2018-13274

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A SQL injection issue was found in the /coreframe/app/admin/pay/admin/index.php file of WUZHI CMS. The issue is related to the keyValue parameter in the "index.php?m=pay&f=index&v=listing" API endpoint...

CVE-2018-15894: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection was discovered in /coreframe/app/admin/pay/admin/index.php in WUZHI CMS 4.1.0 via the index.php?m=pay&f=index&v=listing keyValue parameter...

CVE-2018-14420

MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=adminadmin&a=doaddsave URI...

Cross site request forgery (csrf)

MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=adminadmin&a=doaddsave URI...