CVE-2018-5665

An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logoheight parameter...

CVE-2017-17909

PHP Scripts Mall Responsive Realestate Script has XSS via the admin/general.php gplus parameter...

CVE-2017-17929

PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter...

CVE-2017-15978

AROX School ERP PHP Script 1.0 allows SQL Injection via the officeadmin/ id parameter...

WordPress WP-Testimonials Plugin SQL Injection Vulnerability

WordPress is a set of blogging platform developed by WordPress Software Foundation using PHP language, which supports setting up personal blog sites on PHP and MySQL servers.WP-Testimonials plugin is one of the plugins that can be used to add 'testimonials' to the sidebar or any page/post...

Mura CMS Cross-Site Scripting Vulnerability

Mura CMS is the content management system that makes it easier and faster to build and update websites. A cross-site scripting vulnerability exists in Mura CMS version 7.0.6967, which can be exploited by remote attackers to inject arbitrary web script or HTML using the admin/?muraAction parameter...

Privilege Escalation

devisesecurityextension is vulnerable to privilege escalation. The library accepts changes to the user parameters when a user is updating their expired passwords, a malicious user can pass the parameter of admin=true to escalate themselves to admin level privilege...

The vulnerability of the Zyxel ZLD operating system, which allows a malicious individual to trigger a service failure.

The Web interface of the Zyxel ZyWALL USG 300 network switch/router contains a vulnerability related to authentication on the client side. This allows a malicious individual to obtain device administrator privileges by manipulating the “IsAdmin” parameter...

Tagit! Tagit2b 2.1.B Build 2 tagmin/readconf.php admin Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/22518/info TagIt! TagBoard is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application...

NETonE PHPBook 1.4.6 Guestbook.PHP Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14390/info NETonE PHPBook is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input to the 'admin' parameter of the 'guestbook.php' script. A successful exploi...

CVE-2009-4980

Multiple cross-site scripting XSS vulnerabilities in Photokorn Gallery 1.81 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 where parameter to search.php and 2 qc parameter to admin.php...

Directory traversal

Directory traversal vulnerability in modules/admincp.php in RoseOnlineCMS 3 B1 and earlier, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the admin parameter...

CVE-2009-4581: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in modules/admincp.php in RoseOnlineCMS 3 B1 and earlier, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the admin parameter...

Code injection

The web-based management interfaces in Sourcefire Defense Center DC and 3D Sensor before 4.8.2 allow remote authenticated users to gain privileges via a $admin value for the admin parameter in an edit action to admin/user/user.cgi and unspecified other components...

CVE-2009-2344: Undefined Security Weakness

The web-based management interfaces in Sourcefire Defense Center DC and 3D Sensor before 4.8.2 allow remote authenticated users to gain privileges via a $admin value for the admin parameter in an edit action to admin/user/user.cgi and unspecified other components...

CVE-2008-2349: Undefined Security Weakness

Zomplog 3.8.2 and earlier allows remote attackers to gain administrative access by creating an admin account via a direct request to install/newuser.php with the admin parameter set to 1...

CVE-2007-6458

SQL injection vulnerability in shop/mainfile.php in 123tkShop 0.9.1 allows remote attackers to execute arbitrary SQL commands via a base64-encoded value of the admin parameter to shop/admin.php...

CVE-2007-6458

SQL injection vulnerability in shop/mainfile.php in 123tkShop 0.9.1 allows remote attackers to execute arbitrary SQL commands via a base64-encoded value of the admin parameter to shop/admin.php...

CVE-2007-6458: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in shop/mainfile.php in 123tkShop 0.9.1 allows remote attackers to execute arbitrary SQL commands via a base64-encoded value of the admin parameter to shop/admin.php...

Directory traversal

Directory traversal vulnerability in admin/index.php in Monkey CMS 0.0.3 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the adminskin parameter...