CVE-2018-18191

Cross-site request forgery CSRF vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password...

Cagintranet GetSimple CMS Cross-Site Scripting Vulnerability

Cagintranet GetSimple CMS is an XML-based content management system CMS from Cagintranet Networks, USA. The system includes a theme selector and editor, component editor, image and file managers, and more. A cross-site scripting vulnerability exists in the admin/edit.php page in Cagintranet...

Frog CMS Cross-Site Request Forgery Vulnerability (CNVD-2019-10139)

Frog CMS is a content management system CMS developed by software developer Philippe Archambault. The system provides tools for page templates, user rights management, and document management. Frog CMS 0.9.5 in admin/? /user/edit/1 is a cross-site request forgery vulnerability that can be exploit...

Cagintranet Networks GetSimple CMS Cross-Site Scripting Vulnerability (CNVD-2018-16498)

Cagintranet Networks GetSimple CMS is an XML-based content management system CMS from Cagintranet Networks, USA. The system includes a theme selector and editor, component editor, image and file managers, and more. A cross-site scripting vulnerability exists in the admin/edit.php file in...

Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2018-08767)

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the plugins/box/pages/pages.admin.php file in Monstra CMS...

SQL injection vulnerability in cms_admin_edit.php file of VANOC enterprise website management system (PHP version)

Vanno enterprise website management system PHP version is a php+MySQL development of php enterprise website management system. An SQL injection vulnerability exists in the cmsadminedit.php file of the Vanno Enterprise Website Management System PHP Edition. An attacker can exploit the vulnerabilit...

MISP Information Disclosure Vulnerability

MISP is a suite of open source software solutions for collecting, storing, distributing and sharing cybersecurity metrics and threats cybersecurity event analysis and malware analysis. A security vulnerability exists in the 'adminedit' function of the app/Controller/UsersController.php file in MI...

PHPSUGAR PHP Melody SQL Injection Vulnerability (CNVD-2017-32539)

PHPSUGAR PHP Melody is a PHP-based content management system for video websites. A SQL injection vulnerability exists in PHPSUGAR PHP Melody versions prior to 2.7.3. A remote attacker can exploit this vulnerability by sending the 'image' parameter to the admin/editcategory.php file to inject SQL...

phpwcms Cross-Site Scripting Vulnerability

phpwcms is a flexible, fast, robust, customer and developer friendly and powerful web-based content management system and cms framework based on PHP and MySQL. A cross-site scripting vulnerability exists in include/inctmpl/admin.edituser.tmpl.php and include/inctmpl/admin.newuser.tmpl.php in...

CVE-2017-15578

In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/editcategory.php...

PT-2017-14109

Name of the Vulnerable Software and Affected Versions PHPSUGAR PHP Melody versions prior to 2.7.3 Description The issue exists due to SQL Injection via the image parameter to the "admin/edit category.php" endpoint. Recommendations For versions prior to 2.7.3, update to version 2.7.3 or later to...

CVE-2017-14725

Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php...

CVE-2017-14725: URL Redirection to Untrusted Site

Before version 4.8.2, WordPress was susceptible to an open redirect attack in wp-admin/edit-tag-form.php and wp-admin/user-edit.php...

PT-2017-13654

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.8.2 Description The issue allows for an open redirect attack. This is related to the files wp-admin/edit-tag-form.php and wp-admin/user-edit.php. Recommendations For versions prior to 4.8.2, update to version 4.8....

FineCMS stored cross-site scripting vulnerability (CNVD-2017-15721)

FineCMS is an efficient and simple small and medium-sized content management system based on PHP+MySql+CI framework development for multiple terminals, including Pc-side web pages and mobile web pages, support for customized content models and member models, and can be customized fields, can be...

WordPress WP Jobs Plugin SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.WP Jobs plugin is one of the post management plugin. A SQL injection vulnerability exists in WordPress WP Jobs plug...

Arbitrary Password Reset Vulnerability in 'Admin_Edit.aspx' File of Micro Xia Online Learning Platform

Micro Xia Online Learning Platform is an online education system based on B/S architecture. An arbitrary password reset vulnerability exists in the 'AdminEdit.aspx' file of the Weixia Online Learning Platform. It allows an attacker to reset the administrator password by entering a new password in...

Serendipity cross-site scripting vulnerability (CNVD-2016-00303)

Serendipity is a PHP-based blogging system. Serendipity serendipityadmin.php script fails to adequately filter the 'serendipityentryid' parameter in the 'edit' admin operation. This allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to...

GetSimple CMS suffers from multiple cross-site scripting vulnerabilities (CNVD-2015-04182)

GetSimple CMS is an XML-based content management system CMS from Cagintranet Networks, USA. The system includes a theme selector and editor, component editor, image and file managers, and more. A cross-site scripting vulnerability exists in Cagintranet Networks GetSimple CMS versions prior to...

CVE-2014-5346: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 activate or 2 deactivate the plugin via the active parameter to wp-admin/edit-comments.php, 3...