13520 matches found
PT-2019-7017
Name of the Vulnerable Software and Affected Versions Simple Machines Forum SMF version 2.0.4 Description The issue allows PHP code injection through the index.php?action=admin;area=languages;sa=editlang API endpoint, specifically via the dictionary parameter. Recommendations For version 2.0.4,...
CVE-2013-7468: Improper Control of Generation of Code
Simple Machines Forum SMF 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter...
CVE-2019-8438: Improper Neutralization of Input During Web Page Generation
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the first textbox of "System setting-site setting" of admin/index.php, aka sitename...
PT-2019-18686
Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description A stored Cross-site Scripting XSS issue was found. The username parameter of the "/install/index.php" page is vulnerable. This can be demonstrated via the "admin/login.php" page. Recommendations For PHPMyWind...
PT-2019-19039
Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A Stored XSS issue was found in the second textbox of "System setting-site setting" in admin/index.php, specifically related to the site domain. Recommendations For DiliCMS version 2.4.0, at the moment, there ...
PT-2019-19762
Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description The issue allows for SQL Injection in the pintuan id parameter to the /index.php endpoint via the module/index/cart.php file. Recommendations For PHPSHE version 1.7, consider restricting access to the cart.php...
PT-2019-19037
Name of the Vulnerable Software and Affected Versions njiandan-cms versions prior to 2013-05-23 Description The issue allows for a CSRF attack via the index.php/admin/user new endpoint to add an administrator. Recommendations For versions prior to 2013-05-23, update to a version released after...
PT-2019-19038
Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A Stored XSS issue was found in the first textbox of "System setting-site setting" in admin/index.php, specifically affecting the site name variable. Recommendations For DiliCMS version 2.4.0, as a temporary...
CVE-2019-8440: Improper Neutralization of Input During Web Page Generation
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox aka site logo of "System setting-site setting" of admin/index.php, aka sitelogo...
CVE-2019-7660: Improper Neutralization of Input During Web Page Generation
An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site Scripting XSS vulnerability, as demonstrated by admin/login.php...
CVE-2018-17426: Improper Neutralization of Input During Web Page Generation
WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI...
CVE-2018-17425: Improper Neutralization of Input During Web Page Generation
WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI...
CVE-2019-8437: Cross-Site Request Forgery (CSRF)
njiandan-cms through 2013-05-23 has index.php/admin/usernew CSRF to add an administrator...
CVE-2019-9626: Improper Neutralization of Special Elements used in an SQL Command
PHPSHE 1.7 allows module/index/cart.php pintuanid SQL Injection to index.php...
CVE-2013-7467: Improper Neutralization of Input During Web Page Generation
Simple Machines Forum SMF 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter...
CVE-2019-8439: Improper Neutralization of Input During Web Page Generation
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the second textbox of "System setting-site setting" of admin/index.php, aka sitedomain...
CVE-2019-9226: Improper Neutralization of Input During Web Page Generation
An issue was discovered in baigo CMS 2.1.1. There is a persistent XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the optbaseBGSITENAME parameter to the bgconsole/index.php?m=opt&c=request URI...
PT-2019-19449
Name of the Vulnerable Software and Affected Versions baigo CMS version 2.1.1 Description A persistent XSS issue allows remote attackers to inject arbitrary web script or HTML via the optbaseBG SITE NAME parameter to the "bg console/index.php?m=opt&c=request" URI. Recommendations For baigo CMS...
