CVE-2018-16772

Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new...

Sql injection

Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new...

CVE-2018-16772

Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new...

CVE-2018-16772

CVE-2018-16772 affects Hoosk v1.7.0. The vulnerability is a cross-site scripting (XSS) issue exploitable via the Navigation Title when creating a new page at admin/pages/new. The attack vector is user-facing via the web interface, with the underlying cause described as a navigation title handling...

Hoosk Cross-Site Scripting Vulnerability

Hoosk is a lightweight user-centered content management system CMS. The system has built-in Codelgniter for creating responsive websites. A cross-site scripting vulnerability exists in Hoosk 1.7.0, which can be exploited by an attacker via the navigation title of a new page entered at...

PLANEX CS-QR20 Arbitrary Code Execution Vulnerability

PLANEX is a Japanese networking brand company brands PCI and PLANEX. We provide products from enterprise customers to home customers e.g., network cards, routers, switches, L3 managed switches, accessories, Bluetooth products, print servers, Apple peripherals, network storage devices, etc.. PLANE...

PT-2018-12945 · Ignited · Ignited Cms

Name of the Vulnerable Software and Affected Versions: Ignited CMS versions prior to 2017-02-19 Description: The issue allows a CSRF attack, enabling an attacker to add pages. This is possible through the "ign/index.php/admin/pages/add page" API endpoint, specifically by manipulating the request ...

Cisco Finesse Server-Side Request Forgery Vulnerability (CNVD-2018-14233)

Cisco Finesse is a suite of call center management software. The software enhances call center service quality, improves customer experience, and increases agent satisfaction. Cisco Finesse suffers from a server-side request forgery vulnerability in the web-based administration pages, which stems...

SQL Injection

dolibarr/dolibarr is vulnerable to SQL injection attacks. The vulnerability exists through the sortfield parameter which affects /accountancy/admin/accountmodel.php, /accountancy/admin/categorieslist.php, /accountancy/admin/journalslist.php, /admin/dict.php, /admin/mailstemplates.php, and...

CVE-2018-9019

SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categorieslist.php, /accountancy/admin/journalslist.php, /admin/dict.php,...

UBUNTU-CVE-2018-9019

SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categorieslist.php, /accountancy/admin/journalslist.php, /admin/dict.php,...

GHSA-MVW8-V767-QHJM Radiant CMS vulnerable to Cross-site Scripting

Radiant CMS 1.1.4 has XSS via crafted Markdown input in the partbodycontent parameter to an admin/pages//edit resource...

Radiant CMS part_body_content parameter cross-site scripting vulnerability

Radiant CMS is a free and open source content management system designed for small teams. A cross-site scripting vulnerability exists in Radiant CMS version 1.1.4. A remote attack can be exploited to inject arbitrary web script or HTML by sending the 'partbodycontent' parameter with specially...

Design/Logic Flaw

Radiant CMS 1.1.4 has XSS via crafted Markdown input in the partbodycontent parameter to an admin/pages//edit resource...

CVE-2018-5216

Radiant CMS 1.1.4 has XSS via crafted Markdown input in the partbodycontent parameter to an admin/pages//edit resource...

CVE-2018-5216

Radiant CMS 1.1.4 has XSS via crafted Markdown input in the partbodycontent parameter to an admin/pages//edit resource...

CVE-2018-5216

Radiant CMS 1.1.4 has XSS via crafted Markdown input in the partbodycontent parameter to an admin/pages//edit resource...

CVE-2017-17827

Piwigo 2.9.2 is vulnerable to Cross-Site Request Forgery via /admin.php?page=configuration&section=main or /admin.php?page=batchmanager&mode=unit. An attacker can exploit this to coerce an admin user into performing unintended actions...

CVE-2017-3191

D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A remote attacker that can access the remote management login page can manipulate the POST request in such a manner as to access some administrator-only pages...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Paid Memberships Pro PMPro plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 s parameter to membershiplevels.php, 2 memberslist.php, or 3 orders.php in adminpages/ or the 4 edit...