CVE-2018-16432: Improper Neutralization of Special Elements used in an SQL Command

BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...

CVE-2018-16432

BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...

Umbraco Code Execution Vulnerability

Umbraco is a Danish company Umbraco a set of use ASP.Net to build , Mysql for data storage content management system CMS. The system supports customized templates , manage users , define permissions on the content and so on. A code execution vulnerability exists in Umbraco versions prior to 7.2.0...

Code execution vulnerability in niubicms

niubicms is by the Nanjing Niukun Network Technology Co., Ltd. independent research and development of the novel website source code, news website source code, for PHP open source system. niubicms code execution vulnerabilities exist. Attackers can take advantage of the vulnerability to upload...

Design/Logic Flaw

An exploitable firmware update vulnerability exists in Insteon Hub running firmware version 1013. The HTTP server allows for uploading arbitrary MPFS binaries that could be modified to enable access to hidden resources which allow for uploading unsigned firmware images to the device. To trigger...

File Upload Vulnerability in Servcorp Highway Project Management Information System

Servcorp Highway Project Management Information System is an engineering project management platform developed for project participants. A file upload vulnerability exists in the Servcorp Expressway Project Management Information System. The vulnerability stems from the failure to strictly restri...

CVE-2018-14028

In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then...

UBUNTU-CVE-2018-14028

In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then...

DEBIAN-CVE-2018-14028

In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then...

CVE-2018-14028

In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then...

CVE-2018-14028: Unrestricted Upload of File with Dangerous Type

In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then...

UBUNTU-CVE-2018-10931

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon...

PT-2018-12284

Name of the Vulnerable Software and Affected Versions WordPress version 4.9.7 Description The issue allows for the upload of PHP files via the admin area without proper verification as ZIP files. Once uploaded, even though the plugin extraction fails, the PHP file remains in a predictable locatio...

CVE-2018-14840

uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads but does block, for example, .htm file uploads...

Cross site scripting

uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads but does block, for example, .htm file uploads...

CVE-2018-14840

uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads but does block, for example, .htm file uploads...

CVE-2018-14840

Subrion CMS 4.2.1 contains a Cross‑Site Scripting (XSS) vulnerability in uploads/.htaccess, where the app does not block .html uploads (while blocking .htm). An attacker can upload a .html file via CKEditor/manager and trigger XSS. Public exploit entries and a related commit reference support thi...

Subrion cross-site scripting vulnerability (CNVD-2018-14782)

Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A cross-site scripting vulnerability exists in uploads/.htaccess in Subrion CMS version 4.2.1, which stems...

PT-2018-12758

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.2.1 Description The issue in Subrion CMS allows for XSS due to the uploads/.htaccess file not blocking .html file uploads, while it does block other file types such as .htm. Recommendations For Subrion CMS version 4.2.1,...

CVE-2018-14840: Improper Neutralization of Input During Web Page Generation

uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads but does block, for example, .htm file uploads...