CVE-2018-14420: Cross-Site Request Forgery (CSRF)

MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=adminadmin&a=doaddsave URI...

PT-2018-12502

Name of the Vulnerable Software and Affected Versions MetInfo version 6.0.0 Description The issue allows for a CSRF attack, enabling the addition of a user account through a doaddsave action to admin/index.php. This can be achieved by accessing a specific URI, such as...

CVE-2018-14331: Cross-Site Request Forgery (CSRF)

An issue was discovered in XiaoCms X1 v20140305. There is a CSRF vulnerability to change the administrator account password via admin/index.php?c=index&a=my...

PT-2018-12446

Name of the Vulnerable Software and Affected Versions XiaoCms X1 version v20140305 Description An issue was discovered that allows for a CSRF vulnerability, enabling an attacker to change the administrator account password via the "admin/index.php?c=index&a=my" API endpoint. Recommendations For...

PT-2018-11541

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description An issue was discovered that allows for Arbitrary Script File Upload, which can result in PHP code execution. This is achievable via the "admin/index.php/template/upload" API endpoint. Recommendations For...

CVE-2018-13021: Unrestricted Upload of File with Dangerous Type

An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI...

CVE-2018-12912: Improper Neutralization of Special Elements used in an SQL Command

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI...

PT-2018-11469

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description A SQL Injection issue was discovered in the admin/controllers/database.php file. The issue can be exploited via the "admin/index.php/database/operate?dbaction=emptytable&tablename=" URI, allowing for potential...

livrefoncier.fr XSS vulnerability

Open Bug Bounty ID: OBB-626506 Description| Value ---|--- Affected Website:| livrefoncier.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Flexit Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-11495

OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\model\catalog\download.php via admin/index.php?route=catalog/download/edit, related to the downloadid. For example, an attacker can download ../../config.php...

CVE-2018-11495: Improper Limitation of a Pathname to a Restricted Directory

OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\model\catalog\download.php via admin/index.php?route=catalog/download/edit, related to the downloadid. For example, an attacker can download ../../config.php...

PT-2018-10591

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns a Reflected XSS that occurs during the login process, specifically involving the login parameter to the admin/index.php endpoint. Recommendations For Monstra CMS version 3.0.4, update to...

PT-2018-10593

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns a session management problem in the Administrations Tab of Monstra CMS. Specifically, changing a password at the "admin/index.php?id=users&action=edit&user id=1" endpoint does not...

CVE-2018-11472: Improper Neutralization of Input During Web Page Generation

Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...

CVE-2018-11092

An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table aka Clear Table action...

CVE-2018-11092: Cross-Site Request Forgery (CSRF)

An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table aka Clear Table action...

PT-2018-10303

Name of the Vulnerable Software and Affected Versions MyBB Admin Notes plugin version 1.1 Description An issue allows an attacker to remotely delete all admin notes. This can be achieved via the "admin/index.php?empty=table" action, which is vulnerable to CSRF. Recommendations For MyBB Admin Note...

CVE-2018-10430

An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...

CVE-2018-10430: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...

PT-2018-9882

Name of the Vulnerable Software and Affected Versions: DiliCMS version 2.4.0 Description: A Stored XSS issue was found in the fourth textbox of "System setting-site setting" in admin/index.php, allowing for potential exploitation. Recommendations: For DiliCMS version 2.4.0, consider restricting...