EUVD-2018-4022

Malware in sbrugna...

EUVD-2018-4858

Malware in sbrugna...

CVE-2022-41495: Server-Side Request Forgery (SSRF)

ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery SSRF via the rssurlnews parameter at /manager/index.php...

CVE-2022-41497: Server-Side Request Forgery (SSRF)

ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery SSRF via the pkgurl parameter at /manager/index.php...

Design/Logic Flaw

joyplus-cms 1.6.0 has XSS in adminplayer.php, related to manager/index.php "system manage" and "add" actions...

CVE-2018-12905

joyplus-cms 1.6.0 has XSS in adminplayer.php, related to manager/index.php "system manage" and "add" actions...

CVE-2018-12905: Improper Neutralization of Input During Web Page Generation

joyplus-cms 1.6.0 has XSS in adminplayer.php, related to manager/index.php "system manage" and "add" actions...

CVE-2018-12039

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring...

Sql injection

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring...

CVE-2018-12039

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring...

CVE-2018-12039: Improper Neutralization of Special Elements used in an SQL Command

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring...

CVE-2014-8774: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in manager/index.php in MODX Revolution 2.x before 2.2.15 allows remote attackers to inject arbitrary web script or HTML via the contextkey parameter...

CVE-2014-2736: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in MODX Revolution before 2.2.14 allow remote attackers to execute arbitrary SQL commands via the 1 session ID PHPSESSID to index.php or remote authenticated users to execute arbitrary SQL commands via the 2 user parameter to connectors/security/message.php ...

CVE-2010-4883: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in manager/index.php in MODx Revolution 2.0.2-pl allows remote attackers to inject arbitrary web script or HTML via the modhash parameter...

CVE-2009-3418: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Plume CMS 1.2.3 allow 1 remote authenticated users to execute arbitrary SQL commands via the m parameter to manager/index.php and 2 remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an editlink action to...

CVE-2008-7243: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in page 34 in MODx CMS 0.9.6.1 and 0.9.6.1p1 allows remote attackers to hijack the authentication of other users for requests that modify passwords via manager/index.php. NOTE: due to the lack of details, it is not clear whether this is related to...

CVE-2008-7242: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in MODx CMS 0.9.6.1 and 0.9.6.1p1 allo remote attackers to inject arbitrary web script or HTML via the 1 search, 2 "a," 3 messagesubject, and 4 messagebody parameters to certain pages as reachable from manager/index.php; 5 highlight, 6 id, 7 email...

CVE-2006-6047: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to include and execute arbitrary local files via a .. dot dot in the f parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then...

CVE-2006-3904: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in manager/index.php in Etomite CMS 0.6.1 and earlier, with magicquotesgpc disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter...