647 matches found
CVE-2018-13308
Cross-site scripting in noticegen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phrases button" field...
CVE-2018-13310
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username...
CVE-2018-13311
System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "sambaUser" POST parameter...
CVE-2018-13317
Password disclosure in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to obtain the plaintext password for the admin user by making a GET request for password.htm...
CVE-2018-13309
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password...
CVE-2018-13312
Cross-site scripting in noticegen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field...
Cross site scripting
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username...
CVE-2018-13312
Cross-site scripting in noticegen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field...
CVE-2018-13310
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username...
CVE-2018-13310
TOTOLINK A3002RU (firmware version 1.0.8) is affected by CVE-2018-13310. The vulnerability is a cross-site scripting flaw in the password.htm page that allows an attacker to cause arbitrary JavaScript execution via the user’s username. Multiple connected sources (NVD entry and CNVD-2018-24105) co...
CVE-2018-13309
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password...
CVE-2018-17826
HisiPHP 1.0.8 allows CSRF via admin.php/admin/user/adduser.html to add an administrator account. The attacker can then use that account to execute arbitrary PHP code by leveraging app/common/model/AdminAnnex.php to add .php to the default list of allowable file-upload types .jpg, .png, .gif, .jpe...
EyouCms v1.0.8 suffers from information leakage vulnerability
Eyou Content Management System EyouCms is developed by php + mysql a set of open source CMS dedicated to small and medium-sized enterprise website construction. EyouCms v1.0.8 information leakage vulnerability , attackers can use the vulnerability to obtain directory information on a remote serve...
Cross site request forgery (csrf)
application/home/controller/debug.php in PHPRAP 1.0.4 through 1.0.8 has SSRF via the /debug URI, as demonstrated by an apiurl=file:////etc/passwd&apimethod=get POST request...
CVE-2018-11032
PHPRAP 1.0.4 through 1.0.8 has SQL Injection via the application/home/controller/project.php search function...
PHPRAP SQL Injection Vulnerability
PHPRAP is a PHP-based lightweight open source document management system . A SQL injection vulnerability exists in PHPRAP versions 1.0.4 through 1.0.8. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands with the 'search' function in the...
PHPRAP Server-Side Request Forgery Vulnerability
PHPRAP is a PHP lightweight open source API interface document management system . A server-side request forgery vulnerability exists in the application/home/controller/debug.php file in PHPRAP versions 1.0.4 through 1.0.8. This vulnerability can be exploited to perform server-side request forger...
CVE-2011-4973
Authentication bypass vulnerability in modnss 1.0.8 allows remote attackers to assume the identity of a valid user by using their certificate and entering 'password' as the password...
