CVE-2018-20703

CubeCart 6.2.2 has Reflected XSS via a /ADMIN-FILE/ query string...

CVE-2018-20703

CubeCart 6.2.2 has Reflected XSS via a /ADMIN-FILE/ query string...

CVE-2018-20703

CubeCart 6.2.2 has Reflected XSS via a /ADMIN-FILE/ query string...

CVE-2018-20703: Improper Neutralization of Input During Web Page Generation

CubeCart 6.2.2 has Reflected XSS via a /ADMIN-FILE/ query string...

PT-2019-10169

Name of the Vulnerable Software and Affected Versions: CubeCart version 6.2.2 Description: The issue is related to Reflected XSS, which can be exploited via a query string in the ADMIN-FILE endpoint. Recommendations: For CubeCart version 6.2.2, update to a newer version that contains a fix for th...

Rhymix CMS Cross-Site Scripting Vulnerability

Rhymix CMS is a PHP-based content management system CMS. A cross-site scripting vulnerability exists in the index.php?module=admin&act=dispModuleAdminFileBox page in Rhymix CMS version 1.9.8.1, which can be exploited by remote attackers to inject arbitrary web script or HTML by uploading a...

Arbitrary file deletion vulnerability in ZZCMS full version

ZZCMS is a free and open source website building system, mainly facing the majority of webmasters. ZZCMS full version of the existence of arbitrary file deletion vulnerability. The vulnerability stems from a problem in the logic of admin/dl.php, which leads to the deletion of arbitrary files from...

CentOS Web Panel Local File Inclusion Vulnerability

CentOS Web Panel is a CentOS Lnuix system administration panel. A local file inclusion vulnerability exists in CentOS Web Panel 0.9.8.480, which can be exploited to achieve local file inclusion by traversing the directory via the admin/index.php?module=fileeditor&file=/... / URI for directory...

PT-2018-14407 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.480 Description: The issue concerns a Cross-Site Scripting XSS problem. It affects the fm current dir parameter in the "admin/fileManager2.php" endpoint, as well as the module, service start, service fullstatus,...

PT-2018-14406 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.480 Description: The issue concerns a Local File Inclusion vulnerability via directory traversal. This can be exploited through the "/admin/index.php?module=file editor&file=/../" URI, which allows access to...

Frog CMS File Upload Vulnerability (CNVD-2019-10141)

Frog CMS is a content management system CMS developed by software developer Philippe Archambault. The system provides tools for page templates, user rights management, and document management. A file upload vulnerability exists in Frog CMS 0.9.5, which can be exploited by an attacker via /admin/?...

CVE-2018-13001

An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the admin.php file of the ./cpshop/ module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability...

CVE-2018-10522

In CMS Made Simple CMSMS through 2.2.7, the "file view" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by ordinary users, because the product exposes unrestricted access to the PHP filegetcontents function...

Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2018-08767)

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the plugins/box/pages/pages.admin.php file in Monstra CMS...

NoneCms Cross-Site Request Forgery Vulnerability

NoneCms is a simple and compact open-source content management system that can be used to quickly build corporate sites, personal blogs, and support mobile. A cross-site request forgery vulnerability exists in application/admin/controller/Admin.php in NoneCms 1.3.0. Attackers can use this...

WordPress Splashing Images Plugin PHP Object Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . Splashing Images wp-splashing-images is used in one of the image selection plugin . A PHP object injection...

Photography CMS Cross-Site Request Forgery Vulnerability

Photography CMS is a photography worksharing CMS content management system. A cross-site request forgery vulnerability exists in Photography CMS version 1.0. A remote attacker can exploit this vulnerability to perform unauthorized actions with the file clients/resources/ajax/ajaxnewadmin.php...

Dotclear admin/auth.php file cross-site scripting vulnerability

Dotclear is a software developer Olivier Meunier developed a free PHP and MySQL-based blog Blog publishing software. A cross-site scripting vulnerability exists in the admin/auth.php file in Dotclear version 2.12.1. This vulnerability can be exploited by remote attackers to inject arbitrary web...

Posty Scubez Posty Readymade Classifieds Unauthorized Access Vulnerability

Posty Scubez Posty Readymade Classifieds is a suite of announcement-based website scripts from Posty India. A security vulnerability exists in Posty Scubez Posty Readymade Classifieds, which stems from the program's failure to perform proper access control on access to the...

CS-Cart administration section file upload vulnerability

CS-Cart is a PHP and MySQL based e-commerce software system developed by CS-Cart team. The system supports third-party software extensions, customized promotional strategies, product filtering definitions, etc. The administration section is one of the management components. A file upload...