126 matches found
CVE-2019-19110
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter...
PT-2026-5160
Name of the Vulnerable Software and Affected Versions M/Monit version 3.7.4 Description An authenticated user can escalate privileges by manipulating the admin parameter. An attacker can send a crafted POST request to the /api/1/admin/users/update endpoint to grant administrative access to a...
Sql injection
An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=language&c=languagegeneral&a=doSearchParameter appno parameter, a different issue than CVE-2019-16997...
CVE-2019-17418
An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=language&c=languagegeneral&a=doSearchParameter appno parameter, a different issue than CVE-2019-16997...
Sql injection
The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin currentsliderid parameter...
CVE-2019-16996
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/productadmin.class.php via the admin/?n=product&c=productadmin&a=dopara&apptype=shop id parameter...
CVE-2017-18614
The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter...
CVE-2019-11393
An issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged users to escalate their privileges to an administrator by requesting a password change and specifying the admin parameter...
M/Monit Elevation of Privilege Vulnerability
M/Monit monitors and manages distributed computer systems, performs automated maintenance and remediation, and performs meaningful causal behavior in the event of an error. An elevation of privilege vulnerability exists in /admin/users/update in versions of M/Monit prior to 3.7.3. An unprivileged...
CVE-2019-11393
An issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged users to escalate their privileges to an administrator by requesting a password change and specifying the admin parameter...
CVE-2019-11393: Weak Password Recovery Mechanism for Forgotten Password
An issue was discovered in /admin/users/update in M/Monit before 3.7.3. It allows unprivileged users to escalate their privileges to an administrator by requesting a password change and specifying the admin parameter...
CVE-2018-18018
SQL Injection exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Galleryid or Gallerytitle parameter...
CVE-2019-9661
Stored XSS exists in YzmCMS 5.2 via the admin/systemmanage/userconfigedit.html "value" parameter,...
CVE-2018-20478
An issue was discovered in S-CMS 1.0. It allows reading certain files, such as PHP source code, via the admin/download.php DownName parameter with a mixed-case extension, as demonstrated by a DownName=download.Php value...
CVE-2018-19506
Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI...
MetInfo Cross-Site Scripting Vulnerability (CNVD-2019-09131)
MetInfo is a Content Management System CMS developed using PHP and Mysql. A cross-site scripting vulnerability exists in MetInfo 6.1.2, which can be exploited by an attacker via the /admin/index.php bigclass parameter in the n=column&a=doadd operation...
CVE-2018-12110
portfolioCMS 1.0.5 has SQL Injection via the admin/portfolio.php preview parameter...
CVE-2018-5671
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extrafield1itemsfielditem1pricepercent parameter...