CVE-2018-6518

Composr CMS 10.0.13 has XSS via the sitename parameter in a page=admin-setupwizard&type=step3 request to /adminzone/index.php...

CVE-2018-6518

Composr CMS 10.0.13 has XSS via the sitename parameter in a page=admin-setupwizard&type=step3 request to /adminzone/index.php...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in admin/setup/config/users.php in poMMo Aardvark PR16.1 allows remote attackers to hijack the authentication of administrators for requests that modify credentials via certain admin parameters...

CVE-2011-5300

CVE-2011-5300 affects poMMo Aardvark PR16.1. a CSRF in admin/setup/config/users.php allows remote attackers to hijack administrator authentication by submitting requests that modify credentials via certain admin_ parameters. Root cause is a CSRF in the credential-modification flow. Impact describ...

CVE-2011-5300: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin/setup/config/users.php in poMMo Aardvark PR16.1 allows remote attackers to hijack the authentication of administrators for requests that modify credentials via certain admin parameters...

PT-2015-3502

Name of the Vulnerable Software and Affected Versions CosmoShop ePRO version 10.05.00 Description A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that modify settings via a setup action. Recommendations For version 10.05.00, a...

PANews 2.0 - Remote PHP Script Code Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/12611/info PaNews is reported prone to a remote PHP script code execution vulnerability. It is reported that PHP script code may be injected into the PaNews software through the 'showcopy' parameter of the 'adminsetup.php...

CVE-2011-4899: Undefined Security Weakness

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate, which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters, and subsequently conduct static...

CVE-2012-0782: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 dbhost, 2 dbname, or 3 uname parameter. NOTE: the vendor disputes the significance of...

CVE-2011-4898: Exposure of Sensitive Information to an Unauthorized Actor

wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier generates different error messages for requests lacking a dbname parameter depending on whether the MySQL credentials are valid, which makes it easier for remote attackers to conduct brute-force attacks via a...

WordPress <= 3.3.1 - Multiple XSS

Because of these vulnerabilities in wp-admin/setup-config.php, the attackers can inject arbitrary web script or HTML. Solution Update WordPress...

PHP Jokesite V 2.0 exec Command Exploit

No description provided by source. ======================================================================================== | Title : PHP Jokesite V 2.0 exec command EXploit | Author : indoushka | email : [email protected] | Home : www.iqs3cur1ty.com | Tested on: windows SP2 Français V.Pnx2 2...

CVE-2007-2254: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin/setup/level2.php in PHP Classifieds 6.04, and probably earlier versions, allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. NOTE: this product was referred to as "Allfaclassfieds" in the original disclosure...

PHP TopSites setup.php Administration Authentication Bypass

The remote host is running PHP TopSites, a PHP/MySQL-based customizable TopList script. There is a vulnerability in this software which allows an attacker to access the admin/setup interface without authentication. %NASLMINLEVEL 70300 Josh Zlatin-Amishav GPLv2 Changes by Tenable: - Fixed script...

paNews 2.0.4b Multiple Input Validation Vulnerabilities

The remote host is running a version of paNews that suffers from the following vulnerabilities: - SQL Injection Issue in the 'login' method of includes/auth.php. A remote attacker can leverage this vulnerability to add users with arbitrary privileges. - Local Script Injection Vulnerability in...

paNews v2.0b4 - PHP Injection

oooo oooo oooooooo8 ooooooooooo 8888o 88 888 88 888 88 88 888o88 888oooooo 888 88 8888 888 888 o88o 88 o88oooo888 o888o Network security team nst.e-nex.com Title: paNews v2.0b4 Bug found by: тёмыч Date: 20.02.2005 web: http://www.phparena.net/panews.php google: allintitle:paNews v2.0b4 PHP...