CVE-2019-0213

In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the browser and the Archiva...

Design/Logic Flaw

In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the browser and the Archiva...

CVE-2019-10888

A CSRF Issue that can add an admin user was discovered in UKcms v1.1.10 via admin.php/admin/role/add.html...

CVE-2018-20015

YzmCMS v5.2 has admin/role/add.html CSRF...

Cross site request forgery (csrf)

YzmCMS v5.2 has admin/role/add.html CSRF...

CVE-2018-20015

YzmCMS v5.2 has admin/role/add.html CSRF...

Cross site request forgery (csrf)

JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...

springboot_authority cross-site scripting vulnerability

springbootauthority is a backend management system. The system includes modules for user management, role management, and resource connection management. A cross-site scripting vulnerability exists in the admin/role/edit page in springbootauthority 2017-03-06 and earlier versions, which can be...

Cross site scripting

An issue was discovered in springbootauthority through 2017-03-06. There is stored XSS via the admin/role/edit roleKey, name, or description parameter...

CVE-2018-17369

An issue was discovered in springbootauthority through 2017-03-06. There is stored XSS via the admin/role/edit roleKey, name, or description parameter...

CVE-2018-17369

CVE-2018-17369 affects the SpringBoot Authority project up to 2017-03-06, with a stored XSS vulnerability on the admin/role/edit page through the parameters roleKey, name, or description. The issue is documented across multiple sources (NVD, CNVD, CVE records) and is described as input-based stor...

CVE-2018-16448

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

CVE-2018-11061

RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable to a server-side template injection vulnerability due to insecure configuration of the template engine used in the product. A remote authenticated malicious RSA NetWitness Server...

CVE-2018-11061

RSA NetWitness Platform versions prior to 11.1.0.2 and RSA Security Analytics versions prior to 10.6.6 are vulnerable to a server-side template injection vulnerability due to insecure configuration of the template engine used in the product. A remote authenticated malicious RSA NetWitness Server...

Taxonomy Entity Queue - Critical - SQL Injection - SA-CONTRIB-2018-052

This module enables you to create an entityqueue based on a taxonomy. The module did not properly use Drupal's database API when querying the database with user supplied values, allowing an attacker to send a specially crafted request to modify the query or potentially perform additional queries...

CVE-2018-10821

Cross-site scripting XSS vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated users with the Admin role to inject arbitrary web script or HTML via the search panel...

Cross site scripting

Cross-site scripting XSS vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated users with the Admin role to inject arbitrary web script or HTML via the search panel...

CVE-2018-10821

Cross-site scripting XSS vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated users with the Admin role to inject arbitrary web script or HTML via the search panel...

CVE-2018-10821

Cross-site scripting XSS vulnerability in backend/pages/modify.php in BlackCatCMS 1.3 allows remote authenticated users with the Admin role to inject arbitrary web script or HTML via the search panel...

Cross site request forgery (csrf)

A CSRF issue was discovered on the User Add/System Settings Page system-settings-user-new2.php in EasyService Billing 1.0. A User can be added with the Admin role...