CVE-2021-34651: Improper Neutralization of Input During Web Page Generation

The Scribble Maps WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the map parameter in the /includes/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

PT-2021-20619

Name of the Vulnerable Software and Affected Versions: Scribble Maps WordPress plugin versions up to and including 1.2 Description: The issue concerns Reflected Cross-Site Scripting, allowing attackers to inject arbitrary web scripts via the map parameter in the /includes/admin.php file. This...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability exists in DamiCMS v6.0.6 that can add an admin account via admin.php?s=/Admin/doadd...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability in bycms v1.3 via admin.php/systems/index/moduleid/70/groupid/1.html...

CVE-2020-18460

Cross Site Request Forgery CSRF vulnerability exists in 711cms v1.0.7 that can add an admin account via admin.php?c=Admin&m=content...

CVE-2020-18457

Cross Site Request Forgery CSRF vulnerability exists in bycms v1.3.0 that can add an admin account via admin.php/ucenter/add.html...

CVE-2020-18454

Cross Site Request Forgery CSRF vulnerability in bycms v1.3 via admin.php/systems/index/moduleid/70/groupid/1.html...

CVE-2020-18454

Cross Site Request Forgery CSRF vulnerability in bycms v1.3 via admin.php/systems/index/moduleid/70/groupid/1.html...

PT-2021-18191

Name of the Vulnerable Software and Affected Versions: Pear Admin Think through version 2.1.2 Description: The issue allows attackers to execute arbitrary code remotely due to an arbitrary file upload vulnerability. This is possible because a .php file can be uploaded via the...

CVE-2020-18460: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability exists in 711cms v1.0.7 that can add an admin account via admin.php?c=Admin&m=content...

CVE-2020-18454: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability in bycms v1.3 via admin.php/systems/index/moduleid/70/groupid/1.html...

PT-2021-10180

Name of the Vulnerable Software and Affected Versions: DamiCMS version 6.0.6 Description: A Cross Site Request Forgery CSRF issue exists, allowing the addition of an admin account via the "admin.php?s=/Admin/doadd" endpoint. This can be exploited to gain unauthorized access. Recommendations: For...

PT-2021-10181

Name of the Vulnerable Software and Affected Versions: 711cms version 1.0.7 Description: A Cross Site Request Forgery CSRF issue exists, allowing the addition of an admin account via the "admin.php?c=Admin&m=content" endpoint. This can be exploited to gain unauthorized access. Recommendations: Fo...

PT-2021-10179

Name of the Vulnerable Software and Affected Versions: bycms version 1.3.0 Description: A Cross Site Request Forgery CSRF issue exists, allowing an attacker to add an admin account via the "admin.php/ucenter/add.html" endpoint. Recommendations: For bycms version 1.3.0, as a temporary workaround,...

PT-2021-10176

Name of the Vulnerable Software and Affected Versions: bycms version 1.3 Description: A Cross Site Request Forgery CSRF issue was found in bycms. This could potentially allow unauthorized actions on the system. The issue is related to the "admin.php/systems/index/module id/70/group id/1.html"...

CVE-2020-18458: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability exists in DamiCMS v6.0.6 that can add an admin account via admin.php?s=/Admin/doadd...

CVE-2021-29377: Unrestricted Upload of File with Dangerous Type

Pear Admin Think through 2.1.2 has an arbitrary file upload vulnerability that allows attackers to execute arbitrary code remotely. A .php file can be uploaded via admin.php/index/upload because app/common/service/UploadService.php mishandles fileExt...

CVE-2020-18457: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability exists in bycms v1.3.0 that can add an admin account via admin.php/ucenter/add.html...

CVE-2020-21357

A stored cross site scripting XSS vulnerability in /admin.php?mod=user&act=addnew of PopojiCMS 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the E-Mail field...

CVE-2020-21357: Improper Neutralization of Input During Web Page Generation

A stored cross site scripting XSS vulnerability in /admin.php?mod=user&act=addnew of PopojiCMS 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the E-Mail field...