CVE-2018-18735: Cross-Site Request Forgery (CSRF)

A CSRF issue was discovered in admin/Index/tiquan in catfish blog 2.0.33...

PT-2018-14612

Name of the Vulnerable Software and Affected Versions Catfish CMS version 4.8.30 Description A CSRF issue was discovered in the admin/Index/addmanageuser.html page. Recommendations For Catfish CMS version 4.8.30, update to a newer version that contains a fix for this issue...

PT-2018-14613

Name of the Vulnerable Software and Affected Versions catfish blog version 2.0.33 Description A CSRF issue was discovered in the admin/Index/tiquan endpoint of the catfish blog. Recommendations For catfish blog version 2.0.33, update to a version that includes a fix for this issue, if available. ...

CVE-2018-18734: Cross-Site Request Forgery (CSRF)

A CSRF issue was discovered in admin/Index/addmanageuser.html in Catfish CMS 4.8.30...

CVE-2018-18374

XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter...

MetInfo Cross-Site Scripting Vulnerability (CNVD-2019-09130)

MetInfo is a Content Management System CMS developed using PHP and Mysql. A cross-site scripting vulnerability exists in the admin/index.php page in MetInfo 6.1.2, which can be exploited by an attacker via the anyid parameter...

CVE-2018-18322

CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php servicestart, servicerestart, servicefullstatus, or servicestop parameter...

CVE-2018-18296

MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action...

PT-2018-14405 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.480 Description: The issue concerns Command Injection via shell metacharacters in the admin/index.php API endpoint, specifically in the service start, service restart, service fullstatus, or service stop...

PT-2018-14407 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.480 Description: The issue concerns a Cross-Site Scripting XSS problem. It affects the fm current dir parameter in the "admin/fileManager2.php" endpoint, as well as the module, service start, service fullstatus,...

CVE-2018-18201

qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account...

CVE-2018-17884

XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook gwolle-gb plugin before 2.5.4 for WordPress via the PATHINFO to wp-admin/index.php...

Monstra CMS Arbitrary File Deletion Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A security vulnerability exists in the admin/index.php file in Monstra CMS version 3.0.4. An attacker can...

Monstra CMS Directory Traversal Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A directory traversal vulnerability exists in the admin/index.php file in Monstra CMS version 3.0.4. An...

Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2019-03473)

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the admin/index.php file in Monstra CMS version 3.0.4, which c...

CVE-2018-16774

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete...

CVE-2018-14420

MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=adminadmin&a=doaddsave URI...

CVE-2018-13999

Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter aka an article posted by an administrator...

CVE-2018-13999

Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter aka an article posted by an administrator...

CVE-2018-13999: Improper Neutralization of Input During Web Page Generation

Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter aka an article posted by an administrator...