8 matches found
CVE-2020-20340: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0 allows attackers to access sensitive database information...
CVE-2019-10237: Cross-Site Request Forgery (CSRF)
S-CMS PHP v1.0 has a CSRF vulnerability to add a new admin user via the 4.edu.php/admin/ajax.php?type=admin&action=add&lang=0 URI, a related issue to CVE-2019-9040...
PT-2019-11649
Name of the Vulnerable Software and Affected Versions: S-CMS PHP version 1.0 Description: The issue allows for a CSRF attack to add a new admin user via the "4.edu.php/admin/ajax.php?type=admin&action=add&lang=0" API endpoint. Recommendations: For S-CMS PHP version 1.0, as a temporary workaround,...
Design/Logic Flaw
S-CMS PHP v1.0 has XSS in 4.edu.php via the Sid parameter...
CVE-2019-9925
S-CMS PHP v1.0 has XSS in 4.edu.php via the Sid parameter...
CVE-2019-9925
S-CMS PHP v1.0 has XSS in 4.edu.php via the Sid parameter...
PT-2019-19940
Name of the Vulnerable Software and Affected Versions S-CMS PHP version 1.0 Description The issue affects S-CMS PHP, where there is a problem related to XSS in the 4.edu.php file via the S id parameter. Recommendations For S-CMS PHP version 1.0, avoid using the S id parameter in the 4.edu.php fil...