CVE-2018-6362

EHCP (Easy Hosting Control Panel) version 0.37.12.b is affected by a Cross-Site Scripting vulnerability in the domainop action parameter. The vulnerability allows a crafted request to execute script in a user’s browser and, as demonstrated in public advisories, can lead to reading the PHPSESSID c...

CVE-2018-6362: Improper Neutralization of Input During Web Page Generation

Easy Hosting Control Panel EHCP v0.37.12.b has XSS via the domainop action parameter, as demonstrated by reading the PHPSESSID cookie...

CVE-2018-10314

Cross-site scripting XSS vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the action parameter in the Discover - Audit Scripts - List Scripts - Download section...

PT-2018-9821

Name of the Vulnerable Software and Affected Versions: Open-AudIT Community version 2.2.0 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component. This is demonstrated by the action parameter in the "Discover -...

CVE-2018-10314: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the action parameter in the Discover - Audit Scripts - List Scripts - Download section...

Discuz! DiscuzX Security Bypass Vulnerability (CNVD-2018-02844)

Discuz! DiscuzX is an online forum system. A security bypass vulnerability exists in Discuz! DiscuzX X3.4. A remote attacker can exploit this vulnerability by sending the 'action' parameter to the archiver\index.php file to bypass access restrictions...

CVE-2018-5377

Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via the archiver\index.php action parameter...

PT-2018-16933

Name of the Vulnerable Software and Affected Versions DiscuzX version X3.4 Description The issue allows remote attackers to bypass intended access restrictions. This is achieved via the action parameter in the "archiver/index.php" endpoint. Recommendations For DiscuzX version X3.4, consider...

CVE-2017-16950

Cross - site scripting XSS vulnerability in UrBackup Server before 2.1.20 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

Cross site scripting

Cross - site scripting XSS vulnerability in UrBackup Server before 2.1.20 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2017-16950

Cross - site scripting XSS vulnerability in UrBackup Server before 2.1.20 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2017-16950

Cross - site scripting XSS vulnerability in UrBackup Server before 2.1.20 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2017-16950: Improper Neutralization of Input During Web Page Generation

Cross - site scripting XSS vulnerability in UrBackup Server before 2.1.20 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

PT-2017-14653

Name of the Vulnerable Software and Affected Versions UrBackup Server versions prior to 2.1.20 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the action parameter. Recommendations For UrBackup Server versions prior to 2.1.20, update to...

CVE-2017-14622

Multiple cross-site scripting XSS vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter or 2 kbAction parameter in the kbAmz page to wp-admin/admin.php...

CVE-2017-14530

WPAdminUI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstrated by inserting XSS sequences...

WordPress surveys 'action' variable SQL injection vulnerability

WordPress is a set of blogging platform developed by WordPress Software Foundation using PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.WordPress surveys is a polls plugin developed by Binny VA, an Indian software developer for Wordpress. A SQL injection...

CVE-2017-14416

D-Link DIR-850L REV. A with firmware through FW114WWb07h2abbeta1 devices have XSS in the action parameter to htdocs/web/wandetect.php...

CVE-2017-14415

D-Link DIR-850L REV. A with firmware through FW114WWb07h2abbeta1 devices have XSS in the action parameter to htdocs/web/sitesurvey.php...

PT-2017-13459 · D Link · D-Link Dir-850L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-850L REV. A versions through FW114WWb07 h2ab beta1 Description: The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the presence of a cross-site scripting XSS flaw in the action...