CVE-2019-6779

CVE-2019-6779 affects CSCMS 4.1.8. The vulnerability is a CSRF flaw on the admin.php/links/save endpoint, enabling an attacker to add, modify, or delete friend links without providing proper authorization. Root cause stated is lack of CSRF protection on that admin action; exploitation details are...

ImpressCMS 1.3.11 SQL Injection

Title: ImpressCMS 1.3.11 - 'bid' SQL Injection Date: 21.01.2019 Exploit Author: Mehmet Onder Key Vendor Homepage: http://www.impresscms.org/ Software Link: https://sourceforge.net/projects/impresscms/files/v1.3.11/impresscms1.3.11.zip Version: v1.3.11 Category: Webapps Tested on: WAMPP @Win...

PT-2019-18338

Name of the Vulnerable Software and Affected Versions Cscms version 4.1.8 Description The issue allows for a CSRF attack on the "admin.php/links/save" endpoint to add, modify, or delete friend links. Recommendations For version 4.1.8, update to a newer version that includes a fix for this issue, ...

CVE-2019-6779: Cross-Site Request Forgery (CSRF)

Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links...

CVE-2019-6708

PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...

Sql injection

PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state productid parameter...

Sql injection

PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...

CVE-2019-6708

PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...

CVE-2019-6708

PHPSHE 1.7 contains a SQL injection vulnerability via the admin.php?mod=order state parameter. The Connected documents confirm the vulnerability but do not include explicit impact details, exploit information, or remediation.

CVE-2019-6707

CVE-2019-6707 affects PHPSHE 1.7 and is a SQL injection vulnerability in the admin interface. The injection targets the product_id[] parameter via admin.php?mod=product&act=state, enabling manipulation of the underlying database according to the description. The connected sources confirm the vuln...

Sql injection

phpwind 9.0.2.170426 UTF8 allows SQL Injection via the admin.php?m=backup&c=backup&a=doback tabledb parameter, related to the "--backup database" option...

CVE-2019-6691

phpwind 9.0.2.170426 UTF8 allows SQL Injection via the admin.php?m=backup&c=backup&a=doback tabledb parameter, related to the "--backup database" option...

PT-2019-18276

Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description The issue is related to SQL injection. It occurs via the admin.php?mod=product&act=state API endpoint, specifically through the product id parameter. Recommendations For PHPSHE version 1.7, consider restricting...

PT-2019-18277

Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description The issue is related to SQL injection via the admin.php?mod=order API endpoint, specifically through the state parameter. Recommendations For PHPSHE version 1.7, consider restricting access to the...

CVE-2019-6707: Improper Neutralization of Special Elements used in an SQL Command

PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state productid parameter...

CVE-2019-6708: Improper Neutralization of Special Elements used in an SQL Command

PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...

CVE-2019-6691: Improper Neutralization of Special Elements used in an SQL Command

phpwind 9.0.2.170426 UTF8 allows SQL Injection via the admin.php?m=backup&c=backup&a=doback tabledb parameter, related to the "--backup database" option...

PT-2019-18272

Name of the Vulnerable Software and Affected Versions phpwind version 9.0.2.170426 Description The issue allows SQL Injection via the admin.php?m=backup&c=backup&a=doback endpoint, specifically through the tabledb parameter, related to the "--backup database" option. Recommendations For phpwind...

CVE-2016-10737

Serendipity 2.0.4 has XSS via the serendipityadmin.php serendipitybody parameter...

PT-2019-7536

Name of the Vulnerable Software and Affected Versions Serendipity version 2.0.4 Description The issue is related to a security problem where an attacker can inject malicious code. The problem occurs via the serendipity admin.php endpoint, specifically through the serendipitybody parameter...