CVE-2011-4629

TYPO3 Cross-site Scripting (CVE-2011-4629) affects TYPO3 core prior to 4.3.12, 4.4.x prior to 4.4.9, and 4.5.x prior to 4.5.4. The issue allows remote attackers to inject script/HTML via the admin panel due to insufficient validation of client-side data in the web application. The vulnerability i...

CVE-2011-4629

Cross-site Scripting XSS in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the admin panel...

CVE-2019-17062

An issue was discovered in OXID eShop 6.x before 6.0.6 and 6.1.x before 6.1.5, OXID eShop Enterprise Edition Version 5.2.x-5.3.x, OXID eShop Professional Edition Version 4.9.x-4.10.x and OXID eShop Community Edition Version: 4.9.x-4.10.x. By using a specially crafted URL, users with administrativ...

CVE-2019-9758

An issue was discovered in LabKey Server 19.1.0. The display name of a user is vulnerable to stored XSS that can execute on administrators from security/permissions.view, security/addUsers.view, or wiki/Administration/page.view in the admin panel, leading to privilege escalation...

About Author <= 1.3.9 - Authenticated Stored Cross-Site Scripting (XSS)

Wordpress About Author plugin with a version lower or equal with 1.3.9 is affected by an authenticated Stored Cross-site scripting XSS vulnerability. Stored Cross-site scripting XSS: - Using an Wordpress user, access /wp-admin/post-new.php?posttype=aboutauthor About Author Add new - Insert in...

LimeSurvey cross-site scripting vulnerability (CNVD-2019-36474)

LimeSurvey formerly known as PHPSurveyor is a set of open source online questionnaire survey program from the LimeSurvey team, which supports survey program development, questionnaire distribution, and data collection. A cross-site scripting vulnerability exists in the...

Cross site request forgery (csrf)

qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in...

CVE-2019-17369

OTCMS v3.85 has CSRF in the admin/memberdeal.php Admin Panel page, leading to creation of a new management group account, as demonstrated by superadmin...

Cross site request forgery (csrf)

OTCMS v3.85 has CSRF in the admin/memberdeal.php Admin Panel page, leading to creation of a new management group account, as demonstrated by superadmin...

CVE-2019-17369

OTCMS v3.85 has CSRF in the admin/memberdeal.php Admin Panel page, leading to creation of a new management group account, as demonstrated by superadmin...

CVE-2019-17369

CVE-2019-17369 affects OTCMS v3.85. The vulnerability is a CSRF in the admin/member_deal.php admin panel page, enabling in‑application abuse such as creation of a new management group account (demonstrated by superadmin). The advisory details come from multiple connected sources (NVD/Red Hat/othe...

PRODSECBUG-2290: Cross-Site Scripting via admin panel

More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...

PRODSECBUG-2448: Cross side scripting via admin panel dashboard

More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...

CVE-2019-16996

In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/productadmin.class.php via the admin/?n=product&c=productadmin&a=dopara&apptype=shop id parameter...

Sql injection

In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/productadmin.class.php via the admin/?n=product&c=productadmin&a=dopara&apptype=shop id parameter...

UBUNTU-CVE-2019-16993

In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...

CVE-2019-16703

admin/infolistadd.php in PHPMyWind 5.6 has stored XSS...

Cross site scripting

admin/infolistadd.php in PHPMyWind 5.6 has stored XSS...

Product update: Virtuozzo Infrastructure Platform 3.0 Update 2 (3.0.2-46)

This update provides a new feature as well as fixes and improvements. Vulnerability id: VSTOR-26019 Update Decreased the free space required on the "/boot" partition from 200 MB to 150 MB. Vulnerability id: VSTOR-26041 Admin panel Management node backup would fail if anaconda-ks.cfg was missing...

Opencart 3.x Cross Site Scripting

Exploit Title: Opencart 3.x.x Authenticated Stored XSS Date: 08/15/2019 Exploit Author: Nipun Somani Author Web: http://thehackerstore.net Vendor Homepage: https://www.opencart.com/ Software Link: https://github.com/opencart/opencart Version: 3.x.x Tested on: Debian 9, Windows 10 x64 CVE :...