2947 matches found
CVE-2019-9051: Cross-Site Request Forgery (CSRF)
An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete articles via a /admin.php?action=deletepage&var1= URI...
CVE-2019-9052: Cross-Site Request Forgery (CSRF)
An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures via a /admin.php?action=deleteimage&var1= URI...
Sql injection
Bo-blog Wind through 1.6.0-r allows SQL Injection via the admin.php/comments/batchdel/ comID parameter because this parameter is mishandled in the mode/admin.mode.php delBlockedBatch function...
CVE-2019-7587
Bo-blog Wind through 1.6.0-r allows SQL Injection via the admin.php/comments/batchdel/ comID parameter because this parameter is mishandled in the mode/admin.mode.php delBlockedBatch function...
CVE-2019-7587
CVE-2019-7587 affects Bo-blog Wind through 1.6.0-r. The vulnerability is a SQL Injection in the admin.php/comments/batchdel/ comID parameter, caused by mishandling in the mode/admin.mode.php delBlockedBatch function. The connected sources corroborate the issue and describe it as a SQL injection v...
Cross site scripting
An issue was discovered in Waimai Super Cms 20150505. admin.php?m=Member&a=adminaddsave has XSS via the username or password parameter...
CVE-2019-7570
A CSRF vulnerability was found in PbootCMS v1.3.6 that can delete users via an admin.php/User/del/ucode/ URI...
CVE-2019-7569
An issue was discovered in DOYO aka doyocms 2.320140425 update. There is a CSRF vulnerability that can add a super administrator account via admin.php?c=aadminuser&a=add&run=1...
CVE-2019-7569
DOYO (doyocms) 2.3 (20140425 update) contains a CSRF vulnerability that can add a super administrator account via admin.php?c=a_adminuser&a=add&run=1. The affected component is the web admin interface; the issue enables privilege elevation by creating a new admin user. The connected documents con...
CVE-2019-7570
CVE-2019-7570 applies to PbootCMS v1.3.6, describing a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to delete user accounts via the admin.php/User/del/ucode/ endpoint. The connected sources confirm the affected product/version and the targeted action, with no additional...
PT-2019-18650
Name of the Vulnerable Software and Affected Versions Waimai Super Cms version 20150505 Description An issue was discovered that allows for XSS via the username or password parameter in the "admin.php?m=Member&a=adminaddsave" API endpoint. Recommendations For Waimai Super Cms version 20150505,...
PT-2019-18652
Name of the Vulnerable Software and Affected Versions doyocms version 2.320140425 update Description An issue was discovered that allows for a CSRF vulnerability, enabling the addition of a super administrator account via the "admin.php?c=a adminuser&a=add&run=1" endpoint. The c, a, and run...
PT-2019-18653
Name of the Vulnerable Software and Affected Versions PbootCMS version 1.3.6 Description A CSRF issue was discovered that can lead to the deletion of users. This occurs via the "admin.php/User/del/ucode/" API endpoint. Recommendations For PbootCMS version 1.3.6, consider disabling access to the...
PT-2019-18659
Name of the Vulnerable Software and Affected Versions Bo-blog Wind versions through 1.6.0-r Description The issue allows SQL Injection via the comID parameter in the "admin.php/comments/batchdel/" endpoint because this parameter is mishandled in the delBlockedBatch function in mode/admin.mode.php...
CVE-2019-7587: Improper Neutralization of Special Elements used in an SQL Command
Bo-blog Wind through 1.6.0-r allows SQL Injection via the admin.php/comments/batchdel/ comID parameter because this parameter is mishandled in the mode/admin.mode.php delBlockedBatch function...
CVE-2019-7567: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Waimai Super Cms 20150505. admin.php?m=Member&a=adminaddsave has XSS via the username or password parameter...
CVE-2019-7570: Cross-Site Request Forgery (CSRF)
A CSRF vulnerability was found in PbootCMS v1.3.6 that can delete users via an admin.php/User/del/ucode/ URI...
CVE-2019-7569: Cross-Site Request Forgery (CSRF)
An issue was discovered in DOYO aka doyocms 2.320140425 update. There is a CSRF vulnerability that can add a super administrator account via admin.php?c=aadminuser&a=add&run=1...