195 matches found
WordPress Popup Builder 3.49 Cross Site Scripting
Exploit Title: Wordpress Popup Builder 3.49 - Persistent Cross-Site Scripting Google Dork: inurl:"\wp-content\plugins\popupbuilder" Date: 2019-06-13 Exploit Author: Unk9vvN Vendor Homepage: https://popup-builder.com/ Software Link: https://wordpress.org/plugins/popup-builder/ Version: 3.49 Tested...
WordPress Plugin Popup Builder 3.49 - Persistent Cross-Site Scripting
Exploit Title: Wordpress Popup Builder 3.49 - Persistent Cross-Site Scripting Google Dork: inurl:"\wp-content\plugins\popupbuilder" Date: 2019-06-13 Exploit Author: Unk9vvN Vendor Homepage: https://popup-builder.com/ Software Link: https://wordpress.org/plugins/popup-builder/ Version: 3.49 Tested...
Local File Disclosure via Word Export in Confluence Server - CVE-2019-3394
Confluence Server and Data Center had a local file disclosure vulnerability in the page export function. A remote attacker who has Add Page space permission would be able to read arbitrary files in the /confluence/WEB-INF/ directory and it's subdirectories, which may contain configuration files...
WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2019-05294)
WUZHI CMS is five fingers WUZHI company based on PHP and MySQL open source content management system CMS. WUZHI CMS version 4.1.0 cross-site scripting vulnerability, remote attackers can use the /index.php?m=message&f=message&v=add URL of the 'username' parameter to use the vulnerability to injec...
LFCMS Cross-Site Request Forgery Vulnerability (CNVD-2019-00992)
Lei Feng TV CMS aka LFCMS is a video-on-demand system developed using PHP and MySQL. A cross-site request forgery vulnerability exists in the admin.php?s=/Member/add.html page in LFCMS version 3.8.6. A remote attacker can exploit this vulnerability to perform unauthorized operations...
CVE-2018-20603
Lei Feng TV CMS aka LFCMS 3.8.6 allows admin.php?s=/Member/add.html CSRF...
CVE-2018-18790
An issue was discovered in zzcms 8.3. SQL Injection exists in admin/specialadd.php via a zxbigclassid cookie. This needs an admin user login...
CVE-2018-18431
An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI...
CVE-2018-18317
DESHANG DSCMS 1.1 has CSRF via the public/index.php/admin/admin/add.html URI...
CVE-2018-18317
DESHANG DSCMS 1.1 contains a cross-site request forgery (CSRF) vulnerability exposed via the public/index.php/admin/admin/add.html URI. A remote attacker can perform unauthorized operations through this endpoint. The CVE CVE-2018-18317 is documented in NVD with CVSSv2 base score 6.8 (Partial conf...
DonLinkage Cross-Site Scripting Vulnerability
DonLinkage is a locator program. A cross-site scripting vulnerability exists in the /pages/bazy/bazyadresow.php and /pages/proxy/add.php modules in DonLinkage version 6.6.8. A remote attacker can exploit this vulnerability JavaScript code...
CVE-2018-16449
OneThink 1.1.141212 allows CSRF for adding a page via admin.php?s=/Channel/add.html, adding a blog via admin.php?s=/Article/update.html, and setting the audit state via admin.php?s=/Article/setStatus/status/1.html...
Flexo CMS Cross-Site Request Forgery Vulnerability
Flexo CMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in Flexo CMS version 0.1.6. An attacker can exploit this vulnerability to add an administrator account with the help of the /admin/user/add page...
CVE-2018-15847
An issue was discovered in puppyCMS 5.1. There is an XSS vulnerability via menu.php in the "Add Page/URL" URL link field...
Cross site scripting
An issue was discovered in puppyCMS 5.1. There is an XSS vulnerability via menu.php in the "Add Page/URL" URL link field...
CVE-2018-15847
CVE-2018-15847 affects puppyCMS 5.1: an XSS vulnerability exists in menu.php via the "Add Page/URL" field. The issue allows injection of JavaScript through that link field, as described by multiple sources (NVD/CNVD). CVSS metrics indicate a MEDIUM severity risk (base score 6.1/3.0; network attac...
PT-2018-13236
Name of the Vulnerable Software and Affected Versions puppyCMS version 5.1 Description An issue was discovered in the software, where there is a potential for XSS via the menu.php file in the "Add Page/URL" URL link field. Recommendations For puppyCMS version 5.1, consider restricting access to t...
CVE-2018-15847: Improper Neutralization of Input During Web Page Generation
An issue was discovered in puppyCMS 5.1. There is an XSS vulnerability via menu.php in the "Add Page/URL" URL link field...
Ignited CMS Cross-Site Request Forgery Vulnerability
Ignited CMS is a content management system CMS. A cross-site request forgery vulnerability exists in Ignited CMS 2017-02-19 and prior versions. A remote attacker can exploit the vulnerability to add a page with the help of ign/index.php/admin/pages/addpage URL...