1168 matches found
PT-2019-9291 · WordPress · Wp All Import
Name of the Vulnerable Software and Affected Versions: WP All Import plugin version 3.4.9 Description: There is an issue with the WP All Import plugin for WordPress, specifically via the large feed limit in pmxi-admin-settings, which may allow for an XSS attack. However, the vendor notes that thi...
CentOS Web Panel 0.9.8.793 (Free) 0.9.8.753 (Pro) - Cross-Site Scripting
CentOS Web Panel 0.9.8.793 Free 0.9.8.753 Pro - Cross-Site Scripting Exploit Title: CentOS Web Panel v0.9.8.793 Free and v0.9.8.753 Pro - Email Field Stored Cross-Site Scripting Vulnerability Google Dork: N/A Date: 06 - April - 2019 Exploit Author: DKM Vendor Homepage: http://centos-webpanel.com...
CVE-2019-10106
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section...
CVE-2019-10106
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section...
Design/Logic Flaw
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section...
CVE-2019-10106
CMS Made Simple 2.2.10 exposes a Cross-Site Scripting (XSS) vulnerability in the News module. The issue stems from lack of proper validation in the moduleinterface.php Name field, reachable via Add Category under Site Admin Settings. Multiple sources (NVD, RH, CNVD, CVE list) corroborate an XSS c...
CVE-2019-10106
CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field, which is reachable via an "Add Category" action to the "Site Admin Settings - News module" section...
Cross site request forgery (csrf)
Pluck v4.7.7 allows CSRF via admin.php?action=settings...
CVE-2018-16634
Pluck v4.7.7 allows CSRF via admin.php?action=settings...
CVE-2018-16634
Pluck v4.7.7 allows CSRF via admin.php?action=settings...
CVE-2018-16634
Pluck v4.7.7 allows CSRF via admin.php?action=settings...
Cross-site Scripting Vulnerability in Discuz!
Discuz! is a very popular Web forum program in the Chinese community. A cross-site scripting vulnerability exists in Discuz! X3.4, which stems from the failure of admincp/admincpsetting.php and template\default\common\footer.htm to properly handle the statcode field, which can be exploited to...
CVE-2018-19170
In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the webname parameter...
CVE-2018-18416
LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the sitename parameter to the admin/settings/update URI...
CVE-2018-18416
LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the sitename parameter to the admin/settings/update URI...
CVE-2018-18209
CVE-2018-18209 affects DiliCMS 2.4.0. A reflected XSS exists via the admin/index.php/setting/site?tab=site_attachment parameter (attachment_type). Underlying issue is input handling that allows HTML/script injection, with potential exposure to sensitive data as described in CNVD-2019-17479 and CN...
Avaya Aura Orchestration Designer Runtime Config Component Cross-Site Request Forgery Vulnerability
Avaya Aura Orchestration Designer is a suite of full-featured graphical development environments from Avaya, Inc. It is used to develop applications that run on media processing servers, voice portals, and interactive response software platforms.Runtime Config is one of the runtime environment...
CVE-2018-15612
A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1...
PT-2018-13897 · Getsimple · Getsimple Cms
Name of the Vulnerable Software and Affected Versions: GetSimple CMS version 3.3.13 Description: An issue was discovered that allows for a CSRF vulnerability, which can change the administrator's password via the "admin/settings.php" endpoint. The vendor reported that the proof of concept was...