CVE-2017-11678: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Hashtopus 1.5g allows remote authenticated users to execute arbitrary SQL commands via the format parameter in admin.php...

CVE-2017-11677: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Hashtopus 1.5g allows remote attackers to inject arbitrary web script or HTML via the query string to admin.php...

CVE-2017-11679: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF exists in Hashtopus 1.5g via the password parameter to admin.php in an a=config action...

PT-2017-12168

Name of the Vulnerable Software and Affected Versions Hashtopus version 1.5g Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the query string to "admin.php". This could potentially lead to unauthorized actions on the affected system...

PT-2017-12170

Name of the Vulnerable Software and Affected Versions Hashtopus version 1.5g Description A Cross-Site Request Forgery CSRF issue exists, allowing unauthorized actions via the password parameter to "admin.php" in an "a=config" action. Recommendations For version 1.5g, consider restricting access t...

CVE-2017-9836: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Piwigo 2.9.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the virtualname parameter to /admin.php i.e., creating a virtual album...

PT-2017-19208

Name of the Vulnerable Software and Affected Versions Piwigo version 2.9.1 Description A cross-site scripting XSS issue allows remote authenticated administrators to inject arbitrary web script or HTML via the virtual name parameter to "/admin.php" when creating a virtual album. Recommendations F...

PT-2017-18914

Name of the Vulnerable Software and Affected Versions Event List plugin version 0.7.8 Description The issue allows an authenticated user to execute arbitrary SQL commands. This is achieved via the id parameter to the "wp-admin/admin.php" endpoint. Recommendations For Event List plugin version...

CVE-2017-9429: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to wp-admin/admin.php...

Sql injection

SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php...

CVE-2017-9418

SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php...

Design/Logic Flaw

admin.php in BigTree through 4.2.18 allows remote authenticated users to cause a denial of service inability to save revisions via XSS sequences in a revision name...

CVE-2017-9548

admin.php in BigTree through 4.2.18 has a Cross-site Scripting XSS vulnerability, which allows remote authenticated users to inject arbitrary web script or HTML by launching a Home Template Edit Page action and entering the Navigation Title of a page that is scheduled for future publication aka a...

CVE-2017-9546

admin.php in BigTree through 4.2.18 allows remote authenticated users to cause a denial of service inability to save revisions via XSS sequences in a revision name...

CVE-2017-9547

admin.php in BigTree through 4.2.18 has a Cross-site Scripting XSS vulnerability, which allows remote authenticated users to inject arbitrary web script or HTML by launching an Edit Page action and entering the Navigation Title or Page Title of a page that is scheduled for future publication aka ...

CVE-2017-9548

admin.php in BigTree through 4.2.18 has a Cross-site Scripting XSS vulnerability, which allows remote authenticated users to inject arbitrary web script or HTML by launching a Home Template Edit Page action and entering the Navigation Title of a page that is scheduled for future publication aka a...

CVE-2017-9546

CVE-2017-9546 concerns BigTree CMS prior to 4.2.19 (BigTree 4.2.18 and earlier). The vulnerability exists in admin.php and allows remote authenticated users to trigger a denial of service by supplying crafted XSS sequences in a revision name, causing an inability to save revisions. Connected sour...

CVE-2017-9548

Summary: CVE-2017-9548 affects BigTree CMS up to version 4.2.18 (BigTree). The vulnerability is a cross-site scripting (XSS) flaw in admin.php that allows remote authenticated users to inject arbitrary script or HTML by using the Home Template Edit Page action and setting the Navigation Title for...

CVE-2017-9548

admin.php in BigTree through 4.2.18 has a Cross-site Scripting XSS vulnerability, which allows remote authenticated users to inject arbitrary web script or HTML by launching a Home Template Edit Page action and entering the Navigation Title of a page that is scheduled for future publication aka a...

CVE-2017-9546

admin.php in BigTree through 4.2.18 allows remote authenticated users to cause a denial of service inability to save revisions via XSS sequences in a revision name...