95 matches found
CVE-2018-19138: Cross-Site Request Forgery (CSRF)
WSTMart 2.0.7 has CSRF via the index.php/admin/staffs/add.html URI...
PT-2018-14602
Name of the Vulnerable Software and Affected Versions YUNUCMS version 1.1.5 Description A cross-site scripting XSS issue was found in the "index.php/admin/category/editcategory?id=73" API endpoint. This issue affects the ability to securely manage categories. Recommendations For YUNUCMS version...
PT-2018-14598
Name of the Vulnerable Software and Affected Versions YUNUCMS version 1.1.5 Description A cross-site scripting XSS issue was found in the index.php/admin/system/basic endpoint of YUNUCMS. Recommendations For YUNUCMS version 1.1.5, update to a newer version that contains a fix for this issue...
CVE-2018-18720: Improper Neutralization of Input During Web Page Generation
An XSS issue was discovered in index.php/admin/system/basic in YUNUCMS 1.1.5...
PT-2018-14601
Name of the Vulnerable Software and Affected Versions YUNUCMS version 1.1.5 Description A cross-site scripting XSS issue was found in the "index.php/admin/area/editarea/id/110000" endpoint. This issue allows for potential malicious script execution. Recommendations For YUNUCMS version 1.1.5, upda...
CVE-2018-18724: Improper Neutralization of Input During Web Page Generation
An XSS issue was discovered in index.php/admin/category/editcategory?id=73 in YUNUCMS 1.1.5...
CVE-2018-18723: Improper Neutralization of Input During Web Page Generation
An XSS issue was discovered in index.php/admin/area/editarea/id/110000 in YUNUCMS 1.1.5...
CVE-2018-18417
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI...
PT-2018-14448
Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM version 3.1 Description A Stored XSS issue has been found in the input and upload sections of the software. This is demonstrated by the name parameter to the "index.php/admin/client/create" URI. Recommendations For...
CVE-2018-18417: Improper Neutralization of Input During Web Page Generation
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI...
Ekushey Project Manager CRM 3.1 Cross Site Scripting Vulnerability
Ekushey Project Manager CRM version 3.1 suffers from a persistent cross site scripting vulnerability. Exploit Title: Ekushey Project Manager CRM 3.1 - Cross-site Scripting Exploit Author: Ismail Tasdelen Vendor Homepage: http://creativeitem.com/ Software Link : http://creativeitem.com/demo/ekushe...
PT-2018-14401
Name of the Vulnerable Software and Affected Versions DESHANG DSCMS version 1.1 Description The issue is related to a CSRF problem. It affects the "public/index.php/admin/admin/add.html" URI. Recommendations For DESHANG DSCMS version 1.1, consider implementing proper CSRF protection mechanisms to...
CVE-2018-18317: Cross-Site Request Forgery (CSRF)
DESHANG DSCMS 1.1 has CSRF via the public/index.php/admin/admin/add.html URI...
CVE-2018-15203
An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/addpage allows a CSRF attack to add pages...
CVE-2018-15203: Cross-Site Request Forgery (CSRF)
An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/addpage allows a CSRF attack to add pages...
PT-2018-9972
Name of the Vulnerable Software and Affected Versions: BigTree versions 4.2.22 and earlier Description: The issue allows remote attackers to upload and execute arbitrary PHP code. This is because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess...
CVE-2018-10267: Cross-Site Request Forgery (CSRF)
WTCMS 1.0 has a CSRF vulnerability to add an administrator account via the index.php?admin&m=user&a=addpost URI...
PT-2018-9765
Name of the Vulnerable Software and Affected Versions: YzmCMS version 3.8 Description: An issue was discovered that allows for a CSRF vulnerability, enabling the addition of an admin account via the "/index.php/admin/admin manage/add.html" API endpoint. Recommendations: For YzmCMS version 3.8,...
PT-2018-9766
Name of the Vulnerable Software and Affected Versions: YzmCMS version 3.8 Description: A CSRF issue allows adding a tag via the "/index.php/admin/tag/add.html" API endpoint. Recommendations: For YzmCMS version 3.8, consider implementing CSRF protection measures to prevent unauthorized actions, su...