566 matches found
CVE-2019-8407: Improper Limitation of a Pathname to a Restricted Directory
HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI...
CVE-2019-7718: Concurrent Execution using Shared Resource with Improper Synchronization
An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=...
CVE-2019-6127: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in XiaoCms 20141229. It allows admin/index.php?c=database table SQL injection. This can be used for PHP code execution via "INTO OUTFILE" with a .php filename...
CVE-2018-19556: Improper Input Validation
zbsystem/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing. NOTE: the software maintainer disputes that this is a vulnerability...
CVE-2018-19463: Improper Control of Generation of Code
zbsystem/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zbsystem/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can run PHP b...
CVE-2018-18774
CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter...
CVE-2018-18774: Improper Neutralization of Input During Web Page Generation
CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter...
CVE-2018-18773: Cross-Site Request Forgery (CSRF)
CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password...
CVE-2018-18772: Cross-Site Request Forgery (CSRF)
CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=sendssh, as demonstrated by executing an arbitrary OS command...
CVE-2018-19291: Cross-Site Request Forgery (CSRF)
An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI...
CVE-2018-19192
An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the datacontent parameter...
CVE-2018-19192: Cross-Site Request Forgery (CSRF)
An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the datacontent parameter...
CVE-2018-19194: Exposure of Sensitive Information to an Unauthorized Actor
An issue was discovered in XiaoCms 20141229. /admin/index.php?c=database allows full path disclosure in a "failed to open stream" error message...
CVE-2018-19051
MetInfo 6.1.3 is affected by a cross-site scripting (XSS) vulnerability exploitable through the admin/index.php?a=dogetpassword abt_type parameter. The issue is tied to MetInfo’s admin input handling, enabling XSS in the context of the injected parameter. Connected sources consistently reference ...
CVE-2018-19050: Improper Neutralization of Input During Web Page Generation
MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter...
CVE-2018-19051: Improper Neutralization of Input During Web Page Generation
MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abttype parameter...
CVE-2018-18694: Improper Neutralization of Input During Web Page Generation
admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases...
CVE-2018-18626: Undefined Security Weakness
An issue was discovered in PHPYun V4.6. There is a vulnerability that can delete any file or directory via the "admin/index.php?m=database&c=del" sql parameter because delaction in admin/model/database.class.php mishandles this parameter...