CVE-2024-57279: Improper Neutralization of Input During Web Page Generation

A reflected Cross-Site Scripting XSS vulnerability has been identified in the LDAP User Manager = ce92321, specifically in the /setup/index.php endpoint via the returnto parameter. This vulnerability arises due to improper sanitization of user-supplied input, allowing an attacker to inject...

PT-2025-6005

Name of the Vulnerable Software and Affected Versions LDAP User Manager versions = ce92321 Description A reflected Cross-Site Scripting XSS issue has been identified, specifically in the "/setup/index.php" endpoint via the returnto parameter. This arises due to improper sanitization of...

CVE-2024-57279

A reflected Cross-Site Scripting XSS vulnerability has been identified in the LDAP User Manager = ce92321, specifically in the /setup/index.php endpoint via the returnto parameter. This vulnerability arises due to improper sanitization of user-supplied input, allowing an attacker to inject...

CVE-2014-1631

Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php...

PT-2018-4173

Name of the Vulnerable Software and Affected Versions Eventum versions prior to 2.3.5 Description The issue allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter in the htdocs/setup/index.php file. Recommendations For versions prior to 2.3.5, update to versio...

CVE-2014-1631: Undefined Security Weakness

Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php...

PT-2018-4172

Name of the Vulnerable Software and Affected Versions Eventum versions prior to 2.3.5 Description The issue allows remote attackers to reinstall the application. This can be achieved by making a direct request to the "/setup/index.php" API endpoint. Recommendations For versions prior to 2.3.5,...

CVE-2017-9067

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...

CVE-2017-9067

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...

CVE-2017-9067: Improper Limitation of a Pathname to a Restricted Directory

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...

PT-2017-18683

Name of the Vulnerable Software and Affected Versions MODX Revolution versions prior to 2.5.7 Description The issue arises from insufficient validation of the action parameter to the "setup/index.php" endpoint, allowing an attacker to include and execute arbitrary files on the web server due to...

PT-2017-17665

Name of the Vulnerable Software and Affected Versions MODX Revolution versions 2.5.4-pl and earlier Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the config key parameter to the "setup/index.php?action=welcome" URI. Recommendations For MODX...

CVE-2017-7321: Improper Control of Generation of Code

setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the configkey parameter to the setup/index.php?action=welcome URI...

CVE-2014-4737

Cross-site scripting XSS vulnerability in Textpattern CMS before 4.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to setup/index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in Textpattern CMS before 4.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to setup/index.php...

CVE-2014-4737

Cross-site scripting XSS vulnerability in Textpattern CMS before 4.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to setup/index.php...

PT-2014-6084

Name of the Vulnerable Software and Affected Versions Textpattern CMS versions prior to 4.5.7 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to "setup/index.php". This could potentially lead to unauthorized actions on...

CVE-2014-4737: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Textpattern CMS before 4.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to setup/index.php...

CVE-2013-4997: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in 1 an anchor identifier to setup/index.php or 2 a chartTitle aka chart title value...

PT-2013-5321

Name of the Vulnerable Software and Affected Versions phpMyAdmin versions 3.5.x through 3.5.8.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in 1 an anchor identifier to "setup/index.php" or 2 a chartTitle aka chart...