Cross site request forgery (csrf)

OneThink 1.1.141212 allows CSRF for adding a page via admin.php?s=/Channel/add.html, adding a blog via admin.php?s=/Article/update.html, and setting the audit state via admin.php?s=/Article/setStatus/status/1.html...

Subrion cross-site scripting vulnerability (CNVD-2018-19084)

Subrion is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a variety of extensions plug-ins and more. A cross-site scripting vulnerability exists in Subrion version 4.2.1, which can be exploited by remote attackers ...

idreamsoft iCMS Cross-Site Request Forgery Vulnerability (CNVD-2019-10137)

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in admincp.php?app=group&do=save in idreamsoft iCMS 7.0.10, which can be exploited by an attacker to add an administrator account...

CVE-2018-16365

An issue was discovered in idreamsoft iCMS V7.0.10. admincp.php?app=group&do=save allows CSRF...

CVE-2018-16332

An issue was discovered in iCMS 7.0.9. There is an admincp.php?app=article&do=update CSRF vulnerability...

CVE-2018-16327

There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration...

CVE-2018-16327

There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration...

Cross site scripting

There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration...

CVE-2018-16327

There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration...

CVE-2018-16327

CVE-2018-16327 concerns a stored XSS vulnerability in Subrion CMS 4.2.1 via the admin panel URL configuration . The description across sources confirms the flaw as stored XSS, but the documents do not provide exploitation steps, affected environments beyond the version, root-cause analysis, or an...

CVE-2018-16314

An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRFTOKEN, if CSRFTOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header...

Creasotol 1.0 SQL Injection

Exploit Title : Creasotol Admin Panel Bypass Dork : "DiseA+-o Web : www.creasotol.com" Author : &Warrior& Vendor Homepage : https://creasotol.com Date : 23/08/2018 Version : 1.0 Category : Webapps Tested On : windows 10, firefox Proof Of Concept POC: search google dork : "DiseA+-o Web :...

WordPress Tagregator 0.6 Cross Site Scripting

Exploit Title: WordPress Plugin Tagregator 0.6 - Cross-Site Scripting Date: 2018-05-05 Exploit Author: ManhNho Vendor Homepage: https://wordpress.org/plugins/tagregator/ Software Link: https://downloads.wordpress.org/plugin/tagregator.0.6.zip Ref: https://pastebin.com/ZGr5tyP2 Version: 0.6 Tested...

CVE-2018-12579

An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0; and Community Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0. An...

CVE-2018-12579

An issue was discovered in OXID eShop Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0; and Community Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0. An...

CVE-2018-12579

CVE-2018-12579 affects OXID eShop, spanning Enterprise Edition before 5.3.8, 6.0.x before 6.0.3, and 6.1.x before 6.1.0; Professional Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0; and Community Edition before 4.10.8, 5.x and 6.0.x before 6.0.3, and 6.1.x before 6.1.0....

Code injection

tp5cms through 2017-05-25 has XSS via the admin.php/article/index.html q parameter...

CVE-2018-15566

tp5cms through 2017-05-25 has XSS via the admin.php/article/index.html q parameter...

WordPress Tagregator 0.6 Plugin - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress Plugin Tagregator 0.6 - Cross-Site Scripting Exploit Author: ManhNho Vendor Homepage: https://wordpress.org/plugins/tagregator/ Software Link: https://downloads.wordpress.org/plugin/tagregator.0.6.zip Ref:...

ASUS DSL N10 Authentication Bypass Vulnerability

The ASUS DSL N10 is a wired and wireless modem router. ASUS DSL N10 C1 modem firmware version 1.1.2.217 has the loginauthorization parameter in the post data for authorization to access the admin panel, the data for this parameter is not completely random and an attacker could use old data or dat...