2947 matches found
CVE-2019-9912: Improper Neutralization of Input During Web Page Generation
The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATHINFO...
CVE-2019-9911: Improper Neutralization of Input During Web Page Generation
The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS...
CVE-2019-9910: Improper Neutralization of Input During Web Page Generation
The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS...
CVE-2018-18845: Improper Neutralization of Input During Web Page Generation
internal/advancedcommentsystem/index.php and internal/advancedcommentsystem/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACSpath. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTM...
CVE-2019-9646
The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cpadminintedition.inc.php in the "custom edition area."...
CVE-2019-9646: Improper Neutralization of Input During Web Page Generation
The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cpadminintedition.inc.php in the "custom edition area."...
Cross site request forgery (csrf)
An issue was discovered in Cscms 4.1.0. There is an admin.php/pay CSRF vulnerability that can change the payment account to redirect funds...
CVE-2019-9598
An issue was discovered in Cscms 4.1.0. There is an admin.php/pay CSRF vulnerability that can change the payment account to redirect funds...
CVE-2019-9598
The CVE-2019-9598 entry describes a CSRF vulnerability in Cscms 4.1.0, specifically in the admin.php/pay flow, that allows an attacker to change the payment account and redirect funds. Documents confirm affected software (Cscms 4.1.0) and the vulnerability class (CSRF) with the underlying impact ...
PT-2019-19738
Name of the Vulnerable Software and Affected Versions Cscms version 4.1.0 Description An issue in Cscms allows for a CSRF vulnerability through the admin.php/pay endpoint, potentially enabling an attacker to change the payment account and redirect funds. Recommendations For Cscms version 4.1.0, a...
CVE-2019-9598: Cross-Site Request Forgery (CSRF)
An issue was discovered in Cscms 4.1.0. There is an admin.php/pay CSRF vulnerability that can change the payment account to redirect funds...
Unrestricted file upload
SchoolCMS version 2.3.1 allows file upload via the theme upload feature at admin.php?m=admin&c=theme&a=upload by using the .zip extension along with the Static substring, changing the Content-Type to application/zip, and placing PHP code after the ZIP header. This ultimately allows execution of...
CVE-2019-9572
SchoolCMS version 2.3.1 allows file upload via the theme upload feature at admin.php?m=admin&c=theme&a=upload by using the .zip extension along with the Static substring, changing the Content-Type to application/zip, and placing PHP code after the ZIP header. This ultimately allows execution of...
PT-2019-19721
Name of the Vulnerable Software and Affected Versions Blog2Social plugin versions prior to 5.0.3 Description The issue allows for XSS in the wp-admin/admin.php?page=blog2social-ship API endpoint. No information is provided about the estimated number of potentially affected devices or real-world...
PT-2019-19720
Name of the Vulnerable Software and Affected Versions The Quiz And Survey Master plugin version 6.0.4 Description The issue allows for a quiz id XSS in the wp-admin/admin.php?page=mlw quiz results page. Recommendations For The Quiz And Survey Master plugin version 6.0.4, update to a newer version...
CVE-2019-9575: Improper Neutralization of Input During Web Page Generation
The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlwquizresults quizid XSS...
CVE-2019-9576: Improper Neutralization of Input During Web Page Generation
The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS...
CVE-2019-9572: Unrestricted Upload of File with Dangerous Type
SchoolCMS version 2.3.1 allows file upload via the theme upload feature at admin.php?m=admin&c=theme&a=upload by using the .zip extension along with the Static substring, changing the Content-Type to application/zip, and placing PHP code after the ZIP header. This ultimately allows execution of...