2947 matches found
CVE-2018-7219
application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...
CVE-2018-7219: Cross-Site Request Forgery (CSRF)
application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...
PT-2018-17255
Name of the Vulnerable Software and Affected Versions: Photography CMS version 1.0 Description: A Cross Site Request Forgery CSRF issue exists, allowing attackers to perform unauthorized actions, such as adding an admin account, by exploiting the clients/resources/ajax/ajax new admin.php endpoint...
WordPress responsive-coming-soon-page plugin cross-site scripting vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . responsive-coming-soon-page plugin is used in one of the test system maintenance plugin . A cross-site scriptin...
WordPress responsive-coming-soon-page plugin cross-site scripting vulnerability (CNVD-2018-01255)
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . responsive-coming-soon-page plugin is used in one of the test system maintenance plugin . A cross-site scriptin...
CVE-2018-5692
Piwigo v2.8.2 has XSS via the tab, to, section, mode, installstatus, and display parameters of the admin.php file...
Design/Logic Flaw
Piwigo v2.8.2 has XSS via the tab, to, section, mode, installstatus, and display parameters of the admin.php file...
CVE-2018-5692
Piwigo v2.8.2 has XSS via the tab, to, section, mode, installstatus, and display parameters of the admin.php file...
CVE-2018-5695
The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a request to wp-admin/admin.php...
CVE-2018-5692
Piwigo v2.8.2 has XSS via the tab, to, section, mode, installstatus, and display parameters of the admin.php file...
CVE-2018-5692
Piwigo v2.8.2 is affected by a cross-site scripting (XSS) vulnerability in admin.php. The issue can be triggered by unsafely handling input in the tab, to, section, mode, installstatus, and display parameters, allowing injection of malicious script. This vulnerability is documented across multipl...
CVE-2018-5692
Piwigo v2.8.2 has XSS via the tab, to, section, mode, installstatus, and display parameters of the admin.php file...
CVE-2018-5687
NewsBee (CMS) vulnerability CVE-2018-5687: a stored/reflected XSS is possible via the Company Name field in Settings (admin/admin.php). The description across sources consistently states an XSS vulnerability in NewsBee’s Settings interface. Root cause: improper sanitization/escaping of input in t...
PT-2018-17089
Name of the Vulnerable Software and Affected Versions: Piwigo version 2.8.2 Description: The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved by exploiting the tab, to, section, mode, installstatus, and display parameters of the "admin.php" file...
CVE-2018-5687: Improper Neutralization of Input During Web Page Generation
NewsBee allows XSS via the Company Name field in the Settings under admin/admin.php...
CVE-2018-5692: Improper Neutralization of Input During Web Page Generation
Piwigo v2.8.2 has XSS via the tab, to, section, mode, installstatus, and display parameters of the admin.php file...
PT-2018-17084
Name of the Vulnerable Software and Affected Versions: NewsBee affected versions not specified Description: The issue allows for XSS via the Company Name field in the Settings under the admin/admin.php endpoint. Recommendations: At the moment, there is no information about a newer version that...
Design/Logic Flaw
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php buttontextlink parameter...