13488 matches found
PT-2021-16506
Name of the Vulnerable Software and Affected Versions: OpenCATS versions 0.9.5-3 and earlier Description: The issue arises from the unsafe deserialization of requests to "index.php?m=activity", leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the...
CVE-2020-23644
XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg=XSS to Home/c/ErrorController.php...
CVE-2020-23644
XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg=XSS to Home/c/ErrorController.php...
CVE-2020-23643
XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr=XSS to Home/c/WechatController.php...
PT-2021-10921
Name of the Vulnerable Software and Affected Versions JIZHICMS version 1.7.1 Description A security issue exists where an attacker can execute arbitrary code. The issue is related to the "/index.php/Error/index?msg=" API endpoint, which is vulnerable to XSS attacks. This endpoint is handled by th...
CVE-2020-23644: Improper Neutralization of Input During Web Page Generation
XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg=XSS to Home/c/ErrorController.php...
CVE-2020-23643: Improper Neutralization of Input During Web Page Generation
XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr=XSS to Home/c/WechatController.php...
PT-2021-10920
Name of the Vulnerable Software and Affected Versions JIZHICMS version 1.7.1 Description A security issue exists where an attacker can inject malicious code. The issue is related to the "index.php/Wechat/checkWeixin" API endpoint, specifically with the signature and echostr parameters, where an...
CVE-2021-3111: Improper Neutralization of Input During Web Page Generation
The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI...
PT-2021-19148
Name of the Vulnerable Software and Affected Versions Concrete5 version 8.5.4 Description The issue allows stored XSS via the name field of a new data object at the "index.php/dashboard/express/entries/view/" URI. This occurs in the Express Entries Dashboard. Recommendations For Concrete5 version...
PT-2021-11575
Name of the Vulnerable Software and Affected Versions: MonoCMS Blog version 1.0 Description: The issue is related to incorrect access control, which can lead to remote arbitrary code execution. Specifically, at monofiles/category.php:27, user input can be saved to category/foldername/index.php,...
Advanced Comment System 1.0 - 'ACS_path' Path Traversal
Exploit Title: Advanced Comment System 1.0 - 'ACSpath' Path Traversal Date: Fri, 11 Dec 2020 Exploit Author: Francisco Javier Santiago Vázquez aka "n0ipr0cs" Vendor Homepage: Advanced Comment System - ACS Version: v1.0 CVE: CVE-2020-35598...
CVE-2020-35388
rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true...
Design/Logic Flaw
rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true...
CVE-2020-35388: Undefined Security Weakness
rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true...
PT-2020-17322
Name of the Vulnerable Software and Affected Versions rainrocka xinhu version 2.1.9 Description The issue allows remote attackers to obtain sensitive information via an "index.php?a=gettotal" request in which the ajaxbool value is manipulated to be true. This can lead to unauthorized access to...
CVE-2020-35709
bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...
PT-2020-17398
Name of the Vulnerable Software and Affected Versions bloofoxCMS version 0.5.2.1 Description The issue allows admins to upload arbitrary .php files to ../media/images/ via the "admin/index.php?mode=tools&page=upload" URI, which is a directory traversal issue. This is achieved by using a...
CVE-2020-35709: Improper Limitation of a Pathname to a Restricted Directory
bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...