CVE-2019-17593: Cross-Site Request Forgery (CSRF)

JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator...

CVE-2019-17580: Improper Neutralization of Special Elements used in an SQL Command

tonyy dormsystem through 1.3 allows SQL Injection in admin.php...

CVE-2019-17417

PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs...

PbootCMS Cross-Site Scripting Vulnerability

PbootCMS is a new core open source enterprise building system developed by Avantech. A cross-site scripting vulnerability exists in PbootCMS 2.0.2, which can be exploited to conduct cross-site scripting attacks via routes involving Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URI...

CVE-2019-17417

PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs...

CVE-2019-17417

PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs...

PT-2019-15142

Name of the Vulnerable Software and Affected Versions PbootCMS version 2.0.2 Description The issue allows for XSS attacks through specific URI vectors. The affected API endpoints include "Pboot/admin.php?p=/Single/index/mcode/1" and "Pboot/?contact/". Recommendations For PbootCMS version 2.0.2,...

CVE-2019-17417: Improper Neutralization of Input During Web Page Generation

PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs...

CVE-2015-9454

The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin currentsliderid parameter...

CVE-2015-9452

The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nexformsId parameter...

PT-2019-7413

Name of the Vulnerable Software and Affected Versions smooth-slider plugin versions prior to 2.7 Description The issue concerns SQL Injection via the current slider id parameter in the /wp-admin/admin.php?page=smooth-slider-admin API endpoint. This allows for potential exploitation. No informatio...

CVE-2015-9452: Improper Neutralization of Special Elements used in an SQL Command

The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nexformsId parameter...

CVE-2015-9454: Improper Neutralization of Special Elements used in an SQL Command

The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin currentsliderid parameter...

CVE-2015-9442

The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenirplugin...

CVE-2015-9448

The CVE-2015-9448 issue affects the WordPress SendPress plugin (versions prior to 1.2). The vulnerability is an SQL Injection in the wp-admin/admin.php?page=sp-queue listid parameter. Impact per sources includes manipulation/exfiltration of data via the web interface, with CVSS scores indicating ...

CVE-2015-9440

The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new...

PT-2019-7387

Name of the Vulnerable Software and Affected Versions wplegalpages plugin versions prior to 1.1 Description The issue concerns a CSRF with resultant XSS. It is exploitable via the wp-admin/admin.php?page=legal-pages endpoint with parameters such as lp-domain-name, lp-business-name, lp-phone,...

PT-2019-7399

Name of the Vulnerable Software and Affected Versions monetize plugin versions through 1.03 Description The issue concerns a CSRF vulnerability that leads to XSS. It can be exploited via the "wp-admin/admin.php?page=monetize-zones-new" endpoint. Recommendations For monetize plugin versions throug...

PT-2019-7406

Name of the Vulnerable Software and Affected Versions unite-gallery-lite plugin versions prior to 1.5 Description The issue concerns CSRF and SQL injection flaws. Specifically, the galleryid or id parameters in wp-admin/admin.php are vulnerable. Recommendations For unite-gallery-lite plugin...

PT-2019-7407

Name of the Vulnerable Software and Affected Versions sendpress plugin versions prior to 1.2 Description The issue allows for SQL Injection via the "listid" parameter in the wp-admin/admin.php?page=sp-queue endpoint. Recommendations For versions prior to 1.2, update to version 1.2 or later to...