CVE-2020-18445

Cross Site Scripting XSS vulnerability exists in YUNUCMS 1.1.9 via the upurl function in Page.php...

CVE-2020-18445

Cross Site Scripting XSS vulnerability exists in YUNUCMS 1.1.9 via the upurl function in Page.php...

Cross site scripting

Cross Site Scripting XSS vulnerability exists in YUNUCMS 1.1.9 via the upurl function in Page.php...

CVE-2020-18445

Cross Site Scripting XSS vulnerability exists in YUNUCMS 1.1.9 via the upurl function in Page.php...

CVE-2020-18445

Cross Site Scripting XSS vulnerability exists in YUNUCMS 1.1.9 via the upurl function in Page.php...

PT-2021-10172

Name of the Vulnerable Software and Affected Versions: YUNUCMS version 1.1.9 Description: A Cross Site Scripting XSS issue exists via the upurl function in Page.php. This allows for potential malicious script execution. Recommendations: For YUNUCMS version 1.1.9, consider disabling the upurl...

CVE-2020-18445: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability exists in YUNUCMS 1.1.9 via the upurl function in Page.php...

PT-2021-3656

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 2.25.2 Description The issue is related to a lack of protection of the web page structure in the manage custom field edit page.php component of the MantisBT bug tracking system. This allows a remote attacker to perfo...

PT-2021-18033

Name of the Vulnerable Software and Affected Versions: Bitweaver version 3.1.0 Description: A cross-site scripting XSS issue allows remote attackers to inject JavaScript via the "/users/edit personal page.php" API endpoint. This enables attackers to execute malicious scripts on the client-side...

PT-2021-11698

Name of the Vulnerable Software and Affected Versions: MantisBT versions prior to 2.24.4 Description: The issue allows any unprivileged logged-in user to retrieve Private Projects' names via the project id parameter in the "manage proj edit page.php" page, without having access to them...

PT-2021-11700

Name of the Vulnerable Software and Affected Versions: MantisBT versions prior to 2.24.4 Description: An issue was discovered due to insufficient access-level checks, allowing any logged-in user who can perform Group Actions to access the Summary fields of private Issues via bug arr in a crafted...

PT-2020-17486

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 2.24.4 Description An issue in MantisBT allows an unprivileged attacker to view the Summary field of private issues and bugnotes revisions, potentially gaining access to confidential information. This is achieved via...

PT-2020-16231

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 2.24.3 Description An issue was discovered that allows an attacker to inject HTML and, if Content Security Policy CSP settings permit, achieve execution of arbitrary JavaScript when attempting to update a custom fiel...

CVE-2020-19888

DBHcms v1.2.0 has an unauthorized operation vulnerability because there's no access control at line 175 of dbhcms\page.php for empty cache operation. This vulnerability can be exploited to empty a table...

CVE-2020-19879

DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter of $GET'dbhcmspid' variable in dbhcms\page.php line 107,...

CVE-2020-19888

DBHcms v1.2.0 has an unauthorized operation vulnerability because there's no access control at line 175 of dbhcms\page.php for empty cache operation. This vulnerability can be exploited to empty a table...

CVE-2020-19879

DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter of $GET'dbhcmspid' variable in dbhcms\page.php line 107,...

CVE-2020-19879: Improper Neutralization of Input During Web Page Generation

DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter of $GET'dbhcmspid' variable in dbhcms\page.php line 107,...

CVE-2020-19888: Improper Authentication

DBHcms v1.2.0 has an unauthorized operation vulnerability because there's no access control at line 175 of dbhcms\page.php for empty cache operation. This vulnerability can be exploited to empty a table...

PT-2020-14855

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 2.24.2 Description A security issue was found that allows a remote attacker to inject arbitrary HTML into a page by saving it into a text Custom Field. This occurs due to improper escaping on the view all bug page.ph...