CVE-2019-6779

CVE-2019-6779 affects CSCMS 4.1.8. The vulnerability is a CSRF flaw on the admin.php/links/save endpoint, enabling an attacker to add, modify, or delete friend links without providing proper authorization. Root cause stated is lack of CSRF protection on that admin action; exploitation details are...

ImpressCMS 1.3.11 SQL Injection

Title: ImpressCMS 1.3.11 - 'bid' SQL Injection Date: 21.01.2019 Exploit Author: Mehmet Onder Key Vendor Homepage: http://www.impresscms.org/ Software Link: https://sourceforge.net/projects/impresscms/files/v1.3.11/impresscms1.3.11.zip Version: v1.3.11 Category: Webapps Tested on: WAMPP @Win...

PT-2019-18338

Name of the Vulnerable Software and Affected Versions Cscms version 4.1.8 Description The issue allows for a CSRF attack on the "admin.php/links/save" endpoint to add, modify, or delete friend links. Recommendations For version 4.1.8, update to a newer version that includes a fix for this issue, ...

CVE-2019-6779: Cross-Site Request Forgery (CSRF)

Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links...

CVE-2019-6708

PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...

Sql injection

PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state productid parameter...

Sql injection

PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...

CVE-2019-6708

PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...

CVE-2019-6707

CVE-2019-6707 affects PHPSHE 1.7 and is a SQL injection vulnerability in the admin interface. The injection targets the product_id[] parameter via admin.php?mod=product&act=state, enabling manipulation of the underlying database according to the description. The connected sources confirm the vuln...

CVE-2019-6708

PHPSHE 1.7 contains a SQL injection vulnerability via the admin.php?mod=order state parameter. The Connected documents confirm the vulnerability but do not include explicit impact details, exploit information, or remediation.

Sql injection

phpwind 9.0.2.170426 UTF8 allows SQL Injection via the admin.php?m=backup&c=backup&a=doback tabledb parameter, related to the "--backup database" option...

CVE-2019-6691

phpwind 9.0.2.170426 UTF8 allows SQL Injection via the admin.php?m=backup&c=backup&a=doback tabledb parameter, related to the "--backup database" option...

CVE-2019-6707: Improper Neutralization of Special Elements used in an SQL Command

PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state productid parameter...

PT-2019-18276

Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description The issue is related to SQL injection. It occurs via the admin.php?mod=product&act=state API endpoint, specifically through the product id parameter. Recommendations For PHPSHE version 1.7, consider restricting...

CVE-2019-6708: Improper Neutralization of Special Elements used in an SQL Command

PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...

PT-2019-18277

Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description The issue is related to SQL injection via the admin.php?mod=order API endpoint, specifically through the state parameter. Recommendations For PHPSHE version 1.7, consider restricting access to the...

PT-2019-18272

Name of the Vulnerable Software and Affected Versions phpwind version 9.0.2.170426 Description The issue allows SQL Injection via the admin.php?m=backup&c=backup&a=doback endpoint, specifically through the tabledb parameter, related to the "--backup database" option. Recommendations For phpwind...

CVE-2019-6691: Improper Neutralization of Special Elements used in an SQL Command

phpwind 9.0.2.170426 UTF8 allows SQL Injection via the admin.php?m=backup&c=backup&a=doback tabledb parameter, related to the "--backup database" option...

CVE-2016-10737

Serendipity 2.0.4 has XSS via the serendipityadmin.php serendipitybody parameter...

PT-2019-7536

Name of the Vulnerable Software and Affected Versions Serendipity version 2.0.4 Description The issue is related to a security problem where an attacker can inject malicious code. The problem occurs via the serendipity admin.php endpoint, specifically through the serendipitybody parameter...