179 matches found
CVE-2018-18317
DESHANG DSCMS 1.1 contains a cross-site request forgery (CSRF) vulnerability exposed via the public/index.php/admin/admin/add.html URI. A remote attacker can perform unauthorized operations through this endpoint. The CVE CVE-2018-18317 is documented in NVD with CVSSv2 base score 6.8 (Partial conf...
DonLinkage Cross-Site Scripting Vulnerability
DonLinkage is a locator program. A cross-site scripting vulnerability exists in the /pages/bazy/bazyadresow.php and /pages/proxy/add.php modules in DonLinkage version 6.6.8. A remote attacker can exploit this vulnerability JavaScript code...
CVE-2018-16449
OneThink 1.1.141212 allows CSRF for adding a page via admin.php?s=/Channel/add.html, adding a blog via admin.php?s=/Article/update.html, and setting the audit state via admin.php?s=/Article/setStatus/status/1.html...
Flexo CMS Cross-Site Request Forgery Vulnerability
Flexo CMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in Flexo CMS version 0.1.6. An attacker can exploit this vulnerability to add an administrator account with the help of the /admin/user/add page...
Cross site scripting
An issue was discovered in puppyCMS 5.1. There is an XSS vulnerability via menu.php in the "Add Page/URL" URL link field...
CVE-2018-15847
An issue was discovered in puppyCMS 5.1. There is an XSS vulnerability via menu.php in the "Add Page/URL" URL link field...
CVE-2018-15847
CVE-2018-15847 affects puppyCMS 5.1: an XSS vulnerability exists in menu.php via the "Add Page/URL" field. The issue allows injection of JavaScript through that link field, as described by multiple sources (NVD/CNVD). CVSS metrics indicate a MEDIUM severity risk (base score 6.1/3.0; network attac...
Ignited CMS Cross-Site Request Forgery Vulnerability
Ignited CMS is a content management system CMS. A cross-site request forgery vulnerability exists in Ignited CMS 2017-02-19 and prior versions. A remote attacker can exploit the vulnerability to add a page with the help of ign/index.php/admin/pages/addpage URL...
CVE-2018-15203
An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/addpage allows a CSRF attack to add pages...
CVE-2018-14965
An issue was discovered in EMLsoft 5.4.5. The eml/upload/eml/?action=address&do=add page allows CSRF...
my little forum cross-site scripting vulnerability
my little forum is a set of Internet forum applications based on PHP and MySQL. The application uses a traditional tree view to display information and supports image uploading, template engine, BB code and emoticons. A cross-site scripting vulnerability exists in the Add page option in version...
Design/Logic Flaw
The Add page option in my little forum 2.4.12 allows XSS via the Menu Link field...
CVE-2018-14936
The Add page option in my little forum 2.4.12 allows XSS via the Title field...
CVE-2018-14937
CVE-2018-14937 describes a cross-site scripting (XSS) vulnerability in my little forum 2.4.12, exploitable via the Menu Link field on the Add page. Multiple connected sources corroborate that the issue is an XSS in the Add page option of my little forum 2.4.12. The root cause, as stated across so...
PT-2018-12811 · My Little Forum · My Little Forum
Name of the Vulnerable Software and Affected Versions: my little forum version 2.4.12 Description: The issue allows for XSS via the Title field in the Add page option. Recommendations: For my little forum version 2.4.12, update to a version that fixes this issue, if available. As a temporary...
PT-2018-12812 · My Little Forum · My Little Forum
Name of the Vulnerable Software and Affected Versions: my little forum version 2.4.12 Description: The issue allows for XSS via the Menu Link field in the Add page option. Recommendations: For my little forum version 2.4.12, consider restricting access to the Add page option until a fix is...
idreamsoft iCMS cross-site scripting vulnerability (CNVD-2018-14096)
idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in versions of idreamsoft iCMS prior to 7.0.10. The vulnerability can be exploited by a remote attacker to inject arbitrary web script or HTML via the fourth and fif...
EasyService Billing 1.0 - Cross-Site Request Forgery Vulnerability
Exploit for php platform in category web applications history.pushState'', '', '/' form action="http://test.com/EasyServiceBilling/quotation-new3-new2.php?add=true&id=139" method="P...
