755 matches found
CVE-2017-9759
The vulnerability is a SQL Injection in the open-source CMS Zenbership version 1.0.8, located in the admin/index.php handling the filters array parameter. The issue is exploitable by a privileged account, as described in CVE-2017-9759. The connected sources consistently report this exact flaw but...
CVE-2017-9759: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection exists in admin/index.php in Zenbership 1.0.8 via the filters array parameter, exploitable by a privileged account...
PT-2017-19166
Name of the Vulnerable Software and Affected Versions Zenbership version 1.0.8 Description A SQL Injection issue exists in the admin/index.php file of Zenbership, specifically via the filters array parameter. This issue can be exploited by an attacker with a privileged account. Recommendations Fo...
CVE-2017-7402
Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg...
Design/Logic Flaw
Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg...
CVE-2017-7402: Improper Control of Generation of Code
Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg...
PT-2017-17711
Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows remote authenticated users to upload and execute arbitrary PHP code. This is achieved by sending a POST request to the "admin/index.php?s=publish&x=filemanager" endpoint with a filename that has...
Design/Logic Flaw
Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack...
Design/Logic Flaw
Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack...
CVE-2017-7363
Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack...
CVE-2017-7361
Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack...
CVE-2017-7359
Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack...
CVE-2017-7363
Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack...
CVE-2017-7359
Pixie 1.0.4 contains a cross-site scripting (XSS) vulnerability in the CMS, described as an XSS in Pixie 1.0.4 via admin/index.php s=login&m=. Root cause: improper input validation/handling. Impact per sources indicates potential script injection; exploitation status is not provided in the docume...
CVE-2017-7360
CVE-2017-7360 affects Pixie 1.0.4. The connected documents identify a cross-site scripting vulnerability in the admin interface, specifically in the admin/index.php s=settings&x= parameter, indicating insufficient input validation in the settings handling path. The impact is an XSS where an attac...
CVE-2017-7361
Pixie 1.0.4 is affected by a cross-site scripting (XSS) vulnerability exposed via admin/index.php s=publish&m=static&x=. The CNVD entry states Pixie 1.0.4 contains a cross-site scripting flaw due to improper validation of user-submitted input, allowing a remote attacker to inject arbitrary web sc...
CVE-2017-7363: Improper Neutralization of Input During Web Page Generation
Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack...
CVE-2017-7361: Improper Neutralization of Input During Web Page Generation
Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack...