396 matches found
CVE-2021-41654
SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php...
WUZHI CMS SQL注入漏洞
WUZHI CMS is a PHP and MySQL-based open source content management system CMS from WUZHI. v4.1.0 of WUZHI CMS is vulnerable to SQL injection, which can be exploited to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php. parameter in...
CVE-2022-30776
atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter...
CVE-2022-30776
atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter...
CVE-2022-30776: Improper Neutralization of Input During Web Page Generation
atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter...
Atmail 跨站脚本漏洞
Atmail is an email hosting service from Atmail. Atmail version 6.5.0 contains a cross-site scripting vulnerability that originates from an incorrect parameter in index.php/admin/index/ and can be exploited to execute JavaScript code...
PT-2022-20310
Name of the Vulnerable Software and Affected Versions atmail version 6.5.0 Description The issue allows for XSS via the "index.php/admin/index/" endpoint, specifically through the error parameter. Recommendations For atmail version 6.5.0, consider restricting access to the "index.php/admin/index/...
CVE-2022-27346
Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2022-27346
Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2022-27436
A cross-site scripting XSS vulnerability in /public/admin/index.php?adduser at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username text field...
CVE-2020-20944
An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files...
CVE-2020-20945
A Cross-Site Request Forgery CSRF in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add administrator accounts...
CVE-2021-45018: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability exists in Catfish =6.3.0 via a Google search in url:/catfishcms/index.php/admin/Index/addmenu.htmland then the .html file on the website that uses this editor the file suffix is allowed...
CVE-2021-36548
A remote code execution RCE vulnerability in the component /admin/index.php?id=themes&action=edittemplate&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary commands via a crafted PHP file...
Monstra CMS 代码问题漏洞
Monstra is a lightweight content management system CMS. /admin/index.php?id=themes in Monstra version 3.0.4...
CVE-2020-28145
Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitive information...
CVE-2021-40669
SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/index.php file...
The vulnerability in the implementation of the /app/system/column/admin/index.class.php script of the Metinfo CMS system allows a perpetrator to increase their privileges.
The vulnerability of the /app/system/column/admin/index.class.php implementation in the Metinfo CMS system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...