Design/Logic Flaw

Verydows 2.0 has XSS via the index.php?m=api&c=stats&a=count referrer parameter...

CVE-2019-7753

The connected documents confirm CVE-2019-7753 applies to Verydows 2.0, with an XSS vulnerability exposed via the index.php?m=api&c=stats&a=count referrer parameter. Red Hat and NVD entries corroborate this issue, describing an input/referrer parameter that can inject scripts. No public exploit de...

PT-2019-18744

Name of the Vulnerable Software and Affected Versions Verydows version 2.0 Description The issue is related to a security problem where an attacker can inject malicious code. The estimated number of potentially affected devices worldwide is not available. The problem can be exploited through the...

CVE-2019-7753: Improper Neutralization of Input During Web Page Generation

Verydows 2.0 has XSS via the index.php?m=api&c=stats&a=count referrer parameter...

CVE-2019-7737

A CSRF vulnerability was found in Verydows v2.0 that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit...

CVE-2019-7737

Verydows v2.0 is affected by a CSRF vulnerability that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit. The issue is documented in CVE-2019-7737 with NVD metrics indicating high impact (C/H/I/A) and network attack vector, requiring no authentication. Connected sources c...

CVE-2019-7721

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

CVE-2019-7721

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

CVE-2019-7721

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

PT-2019-18720

Name of the Vulnerable Software and Affected Versions Metinfo versions 6.x Description An issue was discovered that allows an attacker to execute arbitrary PHP code via a race condition in the backend database backup function. This can be achieved by leveraging the admin/index.php and...

PT-2019-18731

Name of the Vulnerable Software and Affected Versions Verydows version 2.0 Description A CSRF issue was discovered that allows adding an admin account via the "index.php?m=backend&c=admin&a=add&step=submit" endpoint, specifically by manipulating the a and step variables. Recommendations For versi...

CVE-2019-7737: Cross-Site Request Forgery (CSRF)

A CSRF vulnerability was found in Verydows v2.0 that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit...

CVE-2019-7721: Unrestricted Upload of File with Dangerous Type

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

CVE-2019-7718: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=...

PT-2019-18723

Name of the Vulnerable Software and Affected Versions nc-cms version 3.5 Description The issue allows for the upload of .php files. This is achieved through the index.php?action=save endpoint, utilizing the name and editordata parameters. Recommendations For nc-cms version 3.5, restrict access to...

Sql injection

An issue was discovered in baijiacms V4 that can result in time-based blind SQL injection to get data via the cate parameter in an index.php?act=index request...

CVE-2019-7568

An issue was discovered in baijiacms V4 that can result in time-based blind SQL injection to get data via the cate parameter in an index.php?act=index request...

CVE-2019-7568

The CVE-2019-7568 issue affects baijiacms V4. It describes a time-based blind SQL injection in the cate parameter exposed through index.php?act=index, enabling data retrieval from the database. The NVD record lists a high/critical risk profile (CVSS v2 base 7.5, CVSS v3 base 9.8) indicating netwo...

PT-2019-18658

Name of the Vulnerable Software and Affected Versions Waimai Super Cms version 20150505 Description An issue was discovered that allows time-based SQL Injection. The /index.php?m=public&a=checkemail URI is vulnerable via the param array parameter in the web/Lib/Action/PublicAction.class.php file...

PT-2019-18631

Name of the Vulnerable Software and Affected Versions Gurock TestRail version 5.3.0.3603 Description The issue concerns the disclosure of potentially sensitive information when an invalid request is made to index.php. This can lead to full path disclosure and the identification of PHP as the...