CVE-2018-19751

DomainMOD 4.11.01 contains a stored cross-site scripting vulnerability in the admin/ssl-fields/add.php page (Display Name, Description & Notes fields). The root cause is input processing that allows injected JavaScript to be stored and executed in the victim’s browser, with potential for session ...

CVE-2016-10732

ProjectSend formerly cFTP r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?fileid=1, or process-zip-download.php, or adduserform parameters to users-add.php...

CVE-2018-17090

An issue was discovered in DonLinkage 6.6.8. The modules /pages/bazy/bazyadresow.php and /pages/proxy/add.php are vulnerable to stored XSS that can be triggered by closing followed by tags...

maskay.com XSS vulnerability

Open Bug Bounty ID: OBB-668673 Description| Value ---|--- Affected Website:| maskay.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

kboing.com.br XSS vulnerability

Vulnerable URL: http://www.kboing.com.br/meu-canal/add.php?url=alert/OPENBUGBOUNTY/...

ThinkSAAS 最新版注入

简要描述： ThinkSAAS 2.4 详细说明： app\group\action\add.php 60行开始 // 执行发布帖子 case "do" : ......省略...... $groupid = intval $POST 'groupid' ; $title = trim $POST 'title' ; $content = tsClean $POST 'content' ; $typeid = intval $POST 'typeid' ; $tag = $POST 'tag'; ......省略...... // 处理@用户名 if pregmatchall '/@/'...

thinksaas最新版xss2

简要描述： 详细说明： \app\group\action\add.php // 执行发布帖子 case "do" : if $POST 'token' != $SESSION 'token' tsNotice '非法操作！' ; $authcode = strtolower $POST 'authcode' ; if $TSSITE 'base' 'isauthcode' if $authcode != $SESSION 'verify' tsNotice "验证码输入有误，请重新输入！" ; $groupid = intval $POST 'groupid' ; $title =...

myBloggie 2.1.2/2.1.3 add.php trackback_url Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/17048/info MyBloggie is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have...

PHPRank 1.8 Add.PHP Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5945/info phpRank is a freely available web site link sharing script. It is available for Unix, Linux, and Microsoft operating systems. It has been reported that phpRank is vulnerable to cross-site scripting attacks. Unde...

saphp Lesson add.php forumid Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/15185/info saphp Lesson is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. Successful...

Sql injection

Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the 1 answerid or 2 questionid parameter to polls/vote.php, 3 storyid parameter to comments/add.php or 4 comments/edit.php, or 5 threadid parameter to posts/add.php. NOTE: this issue...

CVE-2013-5640

Summary: CVE-2013-5640 (and related CVE-2013-7349) affect the Gnew 2013.1 application, with multiple SQL injection vectors. The vulnerabilities allow remote attackers to inject SQL via parameters in polls/vote.php (answer_id, question_id), comments/add.php (story_id) and comments/edit.php, or pos...

ThinkSAAS最新版绕过过滤继续注入2处

简要描述： ThinkSAAS最新版绕过过滤继续注入2处 无视gpc，无需登录 详细说明： 之前这个漏洞有 ′ 雨。分析过： WooYun: Thinksaas某处绕过过滤的注射漏洞 现在官方有最新版，做了修改，加了过滤，但是过滤不严格，可以绕过继续注入。 第一处： 现在最新的代码/app/tag/action/addajax.php case "do": $objname = t$POST'objname'; $idname = tsFiltert$POST'idname'; $objid = t$POST'objid'; $tags = t$POST'tags';...

CVE-2014-1620

CVE-2014-1620 concerns multiple cross-site scripting (XSS) vulnerabilities in the HIOX Guest Book (HGB) version 5.0, specifically in add.php. The issue allows remote attackers to inject arbitrary web script or HTML via the (1) name1, (2) email, or (3) cmt parameters. The NVD entry reports a Mediu...

DEDECMS 5.7 友情链接flink-add.php XSS

No description provided by source...

Raja Natarajan Guestbook 1.0 Local File Inclusion Vulnerability

Exploit for php platform in category web applications Raja Natarajan GUestbook 1.0 Local File Inclusion Exploit App: http://sourceforge.net/projects/phpscript/files/phpscript/Raja%20Guestbook/guestbook1.0.zip/download Author: h0rd Vuln:...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ATutor 1.6.4 allow remote authenticated users, with Instructor privileges, to inject arbitrary web script or HTML via the 1 Question and 2 Choice fields in tools/polls/add.php, the 3 Type and 4 Title fields in tools/groups/createmanual.php, and...

phpcms 2007sp6 digg-add.php Sql注入漏洞

No description provided by source...

CVE-2008-6750

CVE-2008-6750 affects FlexPHPDirectory 0.0.1, where add.php allows unrestricted file uploads. An attacker can upload a file with an executable extension and then access it directly under photo/ to execute code remotely. The underlying issue is unrestricted upload handling in the web application, ...

Sql injection

Multiple SQL injection vulnerabilities in AV Book Library before 1.1 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to 1 admin/edit.php, 2 admin/add.php, 3 lib/booksearch.php, and possibly other components...