CVE-2015-9292: Cross-Site Request Forgery (CSRF)

6kbbs 7.1 and 8.0 allows CSRF via portalchannelajax.php id or code parameter or admin.php fileids parameter...

CVE-2019-14774: Improper Neutralization of Input During Web Page Generation

The woo-variation-swatches aka Variation Swatches for WooCommerce plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter...

PT-2019-9054

Name of the Vulnerable Software and Affected Versions DamiCMS version 6.0.0 Description The issue allows remote authenticated administrators to read any files on the server by crafting a specific URI, /admin.php?s=Tpl/Add/id/. This is an arbitrary file read vulnerability. Recommendations For...

CVE-2018-14831: Exposure of Sensitive Information to an Unauthorized Actor

An arbitrary file read vulnerability in DamiCMS v6.0.0 allows remote authenticated administrators to read any files in the server via a crafted /admin.php?s=Tpl/Add/id/ URI...

PT-2019-13279

Name of the Vulnerable Software and Affected Versions CRUDLab WP Like Button plugin versions prior to 1.6.1 Description The issue allows unauthenticated attackers to change settings due to an authentication bypass. The contains function in wp like button.php did not check if the current request i...

CVE-2018-19461

admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php...

CVE-2018-19461

admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php...

PT-2019-9823

Name of the Vulnerable Software and Affected Versions EmpireCMS versions through 7.5 Description The issue allows for XSS via crafted SQL syntax to the admin/admin.php endpoint. This is achieved by exploiting the admindbDoSql.php file in EmpireCMS. Recommendations For EmpireCMS versions through...

PT-2019-9824

Name of the Vulnerable Software and Affected Versions EmpireCMS versions through 7.5 Description The issue allows remote attackers to execute arbitrary PHP code via SQL injection. This is achieved by using a .php filename in a SELECT INTO OUTFILE statement to admin/admin.php. Recommendations For...

CVE-2018-19461: Improper Neutralization of Input During Web Page Generation

admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php...

CVE-2018-18872: Improper Neutralization of Input During Web Page Generation

The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the eventtitle parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI...

Information disclosure

doorGets 7.0 has a sensitive information disclosure vulnerability in /setup/temp/admin.php and /setup/temp/database.php. A remote unauthenticated attacker could exploit this vulnerability to obtain the administrator password...

CVE-2019-11616

CVE-2019-11616 affects doorGets 7.0. The vulnerability is a sensitive information disclosure in /setup/temp/admin.php and /setup/temp/database.php, allowing a remote unauthenticated attacker to obtain the administrator password. Affected software: doorGets 7.0 (web CMS). Root cause and vector det...

PT-2019-12423

Name of the Vulnerable Software and Affected Versions doorGets version 7.0 Description The issue allows a remote unauthenticated attacker to disclose sensitive information. Specifically, the vulnerability is present in the /setup/temp/admin.php and /setup/temp/database.php API endpoints, which...

CVE-2019-11616: Undefined Security Weakness

doorGets 7.0 has a sensitive information disclosure vulnerability in /setup/temp/admin.php and /setup/temp/database.php. A remote unauthenticated attacker could exploit this vulnerability to obtain the administrator password...

CVE-2018-18017

XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Galleryid or Gallerytitle parameter...

CVE-2018-17584

The WP Fastest Cache plugin 0.8.8.5 for WordPress has CSRF via the wp-admin/admin.php wpfastestcacheoptions page...

CVE-2018-18261

In waimai Super Cms 20150505, there is an XSS vulnerability via the /admin.php/Foodcat/addsave fcname parameter...

Cross site scripting

In waimai Super Cms 20150505, there is an XSS vulnerability via the /admin.php/Foodcat/addsave fcname parameter...

PT-2019-9547

Name of the Vulnerable Software and Affected Versions Tribulant Slideshow Gallery plugin version 1.6.8 Description A security issue exists in the Tribulant Slideshow Gallery plugin for WordPress, allowing for XSS attacks. This is possible through the...