CVE-2019-9551

An issue was discovered in DOYO aka doyocms 2.3 through 2015-05-06. It has admin.php XSS...

PT-2019-19702

Name of the Vulnerable Software and Affected Versions DOYO aka doyocms versions 2.3 through 2015-05-06 Description An issue was discovered in the software, which has an XSS vulnerability in the admin.php file. Recommendations For DOYO aka doyocms versions 2.3 through 2015-05-06, consider disablin...

CVE-2019-9551: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DOYO aka doyocms 2.3 through 2015-05-06. It has admin.php XSS...

CVE-2019-9568: Improper Neutralization of Special Elements used in an SQL Command

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry parameter if the attacker has the delete permission...

Cross site scripting

DhCms through 2017-09-18 has admin.php?r=admin/Index/index XSS...

CVE-2019-9550

DhCms through 2017-09-18 has admin.php?r=admin/Index/index XSS...

CVE-2019-9550

CVE-2019-9550 affects DhCms (DhCms through 2017-09-18) with an XSS in admin.php?r=admin/Index/index. The root cause is a stored/reflected XSS in the admin backend, enabling an attacker to potentially obtain cookie information (per CNVD-2019-08720). Multiple sources (NVD, Red Hat, CNVD) report the...

PT-2019-19701

Name of the Vulnerable Software and Affected Versions DhCms through 2017-09-18 Description The issue is related to an XSS in the admin.php?r=admin/Index/index page. Recommendations For DhCms versions through 2017-09-18, update to a version released after 2017-09-18 to resolve the issue...

CVE-2019-9550: Improper Neutralization of Input During Web Page Generation

DhCms through 2017-09-18 has admin.php?r=admin/Index/index XSS...

CVE-2019-9181

CVE-2019-9181 affects SchoolCMS v2.3.1. The issue arises in the logo upload feature (admin.php?m=admin&c=site&a=save): an attacker can upload a file with a .jpg extension, set Content-Type to image/php, and append PHP code after the JPEG data, enabling arbitrary PHP code execution on the server. ...

CVE-2019-9181: Unrestricted Upload of File with Dangerous Type

SchoolCMS version 2.3.1 allows file upload via the logo upload feature at admin.php?m=admin&c=site&a=save by using the .jpg extension, changing the Content-Type to image/php, and placing PHP code after the JPEG data. This ultimately allows execution of arbitrary PHP code...

PT-2019-19419

Name of the Vulnerable Software and Affected Versions SchoolCMS version 2.3.1 Description The issue allows for file upload via the logo upload feature at "admin.php?m=admin&c=site&a=save" by manipulating the file extension and content type. Specifically, an attacker can use the .jpg extension,...

CVE-2019-9048

An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete a theme aka topic via a /admin.php?action=themedelete&var1= URI...

CVE-2019-9052

An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures via a /admin.php?action=deleteimage&var1= URI...

CVE-2019-9051

An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete articles via a /admin.php?action=deletepage&var1= URI...

PT-2019-19334

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.9-dev1 Description A CSRF issue allows deletion of modules via the "/admin.php?action=module delete&var1=" API endpoint, where var1 is a vulnerable parameter. This can be exploited to delete modules. Recommendations For Pluck...

CVE-2019-9049: Cross-Site Request Forgery (CSRF)

An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete modules via a /admin.php?action=moduledelete&var1= URI...

CVE-2019-9051: Cross-Site Request Forgery (CSRF)

An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete articles via a /admin.php?action=deletepage&var1= URI...

CVE-2019-9052: Cross-Site Request Forgery (CSRF)

An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures via a /admin.php?action=deleteimage&var1= URI...

PT-2019-19333

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.9-dev1 Description A CSRF issue allows deletion of a theme via the "/admin.php?action=theme delete&var1=" API endpoint. Recommendations For Pluck version 4.7.9-dev1, as a temporary workaround, consider restricting access to t...