13533 matches found
CVE-2019-5725
qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file...
CVE-2019-5725: Server-Side Request Forgery (SSRF)
qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file...
PT-2019-17833
Name of the Vulnerable Software and Affected Versions qibosoft versions through V7 Description The issue allows remote attackers to read arbitrary files via the main parameter in member/index.php, which can be exploited through Server-Side Request Forgery SSRF to read sensitive files, such as .sq...
CVE-2019-5488
EARCLINK ESPCMS-P8 has SQL injection in the installpack/index.php?ac=Member&at=verifyAccount verifykey parameter. installpack/espcmspublic/espcmsdb.php may allow retrieving sensitive information from the ESPCMS database...
PT-2019-17706
Name of the Vulnerable Software and Affected Versions EARCLINK ESPCMS-P8 Description The issue concerns a SQL injection in the install pack/index.php ac=Member&at=verifyAccount endpoint, specifically in the verify key parameter. This could potentially allow an attacker to retrieve sensitive...
CVE-2019-5488: Improper Neutralization of Special Elements used in an SQL Command
EARCLINK ESPCMS-P8 has SQL injection in the installpack/index.php?ac=Member&at=verifyAccount verifykey parameter. installpack/espcmspublic/espcmsdb.php may allow retrieving sensitive information from the ESPCMS database...
CVE-2019-5311
An issue was discovered in YUNUCMS V1.1.8. app/index/controller/Show.php has an XSS vulnerability via the index.php/index/show/index cw parameter...
CVE-2019-5311
An issue was discovered in YUNUCMS V1.1.8. app/index/controller/Show.php has an XSS vulnerability via the index.php/index/show/index cw parameter...
PT-2019-17574
Name of the Vulnerable Software and Affected Versions YUNUCMS version 1.1.8 Description An issue was discovered in YUNUCMS, where the app/index/controller/Show.php file has a cross-site scripting XSS vulnerability. This vulnerability can be exploited via the cw parameter in the...
CVE-2019-5311: Improper Neutralization of Input During Web Page Generation
An issue was discovered in YUNUCMS V1.1.8. app/index/controller/Show.php has an XSS vulnerability via the index.php/index/show/index cw parameter...
CVE-2018-19601
Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...
CVE-2018-19600
Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...
CVE-2018-14481
Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...
Design/Logic Flaw
Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...
CVE-2018-14481
Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...
CVE-2018-14481
OSClass 3.7.4 is affected by CVE-2018-14481: it has Cross-Site Scripting (XSS) via the query string to index.php (notably in the OSClass 3.7.4 release, separate from CVE-2014-6280). Other connected sources describe multiple XSS vulnerabilities in OSClass 3.7.4, including potential reflections and...
PT-2019-9874
Name of the Vulnerable Software and Affected Versions Rhymix CMS version 1.9.8.1 Description The issue allows for Server-Side Request Forgery SSRF via an SVG upload in the admin module. This can be achieved by accessing the "index.php?module=admin&act=dispModuleAdminFileBox" endpoint with a...
CVE-2018-19600: Improper Neutralization of Input During Web Page Generation
Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...
PT-2019-9027
Name of the Vulnerable Software and Affected Versions Osclass version 3.7.4 Description The issue is related to a Cross-Site Scripting XSS vulnerability. It occurs via the query string to the "index.php" endpoint. Recommendations For Osclass version 3.7.4, update to a version that includes a fix...
CVE-2018-14481: Improper Neutralization of Input During Web Page Generation
Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...