PT-2019-11990

Name of the Vulnerable Software and Affected Versions 74cms version 5.0.1 Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the site domain parameter in the /index.php?m=Admin&c=config&a=edit API endpoint. Recommendations For version 5.0.1, as a...

Rukovoditel ERP & CRM 2.4.1 - path Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Rukovoditel ERP & CRM 2.4.1 - 'path' Cross-Site Scripting Exploit Author: Javier Olmedo Website: https://hackpuntes.com Vendor: Rukovoditel Software Link: https://sourceforge.net/projects/rukovoditel/ Affected Version: 2.4.1 and...

Nextcloud: [Reflected XSS] In Request URL

In index.php file on 1765 we can see XSS: " Because NextCloud allow links like: '/index.php/ANYCONTENT' If we will do request like: POST /updater/index.php/h"alert1; HTTP/1.1 Host: vulns.local Content-Type: application/x-www-form-urlencoded Content-Length: 33 updater-secret-input=OURSECRET We wil...

Rukovoditel ERP & CRM 2.4.1 - 'path' Cross-Site Scripting

Exploit Title: Rukovoditel ERP & CRM 2.4.1 - 'path' Cross-Site Scripting Exploit Author: Javier Olmedo Website: https://hackpuntes.com Date: 2019-03-24 Google Dork: N/A Vendor: Rukovoditel Software Link: https://sourceforge.net/projects/rukovoditel/ Affected Version: 2.4.1 and possibly before...

CVE-2019-9915

GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...

Open redirect

GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...

CVE-2019-9915

GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...

CVE-2019-9915

GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...

CVE-2019-9915

GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...

CVE-2019-9915

GetSimple CMS 3.3.13 contains an Open Redirect vulnerability exposed via the admin/index.php redirect parameter. An attacker can cause victims to be redirected to a malicious site, with potential for phishing or unauthorized operations depending on the redirected context. The issue is documented ...

PT-2019-19933

Name of the Vulnerable Software and Affected Versions GetSimpleCMS version 3.3.13 Description The issue is related to an Open Redirect via the redirect parameter in the admin/index.php endpoint. Recommendations For GetSimpleCMS version 3.3.13, consider restricting access to the admin/index.php...

CVE-2019-9915: URL Redirection to Untrusted Site

GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...

CVE-2018-18798: Improper Neutralization of Special Elements used in an SQL Command

Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.php?view=view, and user/index.php?view=view...

PT-2019-9631

Name of the Vulnerable Software and Affected Versions Attendance Monitoring System version 1.0 Description The issue concerns a SQL Injection flaw. It affects the id parameter in several API endpoints: "student/index.php?view=view", "event/index.php?view=view", and "user/index.php?view=view"...

CVE-2018-18845: Improper Neutralization of Input During Web Page Generation

internal/advancedcommentsystem/index.php and internal/advancedcommentsystem/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACSpath. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTM...

CVE-2019-7223: Improper Neutralization of Input During Web Page Generation

InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoicepassword parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/ URI. NOTE: this is different from CVE-2018-12255...

PT-2019-18473

Name of the Vulnerable Software and Affected Versions InvoicePlane version 1.5 Description The issue is related to stored XSS via the invoice password parameter, also known as the "PDF password" field, in the "Create Invoice" option. The XSS payload is rendered at an "index.php/invoices/view/" UR...

CVE-2019-9769

PilusCart 1.4.1 is vulnerable to index.php?module=users&action=newUser CSRF, leading to the addition of a new user as administrator...

PT-2019-19877

Name of the Vulnerable Software and Affected Versions FeiFeiCMS version 4.1.190209 Description The issue allows remote attackers to upload and execute arbitrary PHP code. This can be achieved by modifying the set of allowable file extensions through the "Admin-Index" page at the...

CVE-2019-9825: Unrestricted Upload of File with Dangerous Type

FeiFeiCMS 4.1.190209 allows remote attackers to upload and execute arbitrary PHP code by visiting index.php?s=Admin-Index to modify the set of allowable file extensions, as demonstrated by adding php to the default jpg,gif,png,jpeg setting, and then using the "add article" feature...