CVE-2018-19853

CVE-2018-19853 describes an elevation-of-privilege flaw in hitshop (through 2014-07-15) where a storekeeper account can add an administrator via admin.php/user/add, gaining control of the whole site. Affected component: the web application’s user/add workflow; root cause: storekeeper privileges c...

CVE-2018-16634: Cross-Site Request Forgery (CSRF)

Pluck v4.7.7 allows CSRF via admin.php?action=settings...

CVE-2018-16633: Improper Neutralization of Input During Web Page Generation

Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...

CVE-2018-19853: Improper Privilege Management

An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability that allows control over the whole web site via the admin.php/user/add URI because a storekeeper account which is supposed to have only privileges for commodity management can add an...

PT-2018-15129

Name of the Vulnerable Software and Affected Versions hitshop versions prior to 2014-07-15 Description An issue was discovered that allows for elevation-of-privilege, enabling control over the whole website. This is achieved via the "admin.php/user/add" URI, where a storekeeper account, intended...

PT-2018-13660

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.7 Description The issue allows for XSS via the admin.php?action=editpage&page= endpoint, specifically the page parameter. This can be exploited by manipulating the page title. Recommendations For Pluck version 4.7.7, consider...

PT-2018-13661

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.7 Description The issue allows for CSRF via the admin.php?action=settings endpoint. This can potentially be exploited by tricking an administrator into performing unintended actions. Recommendations For Pluck version 4.7.7,...

CVE-2018-19693

An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the title parameter...

Design/Logic Flaw

An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the title parameter...

CVE-2018-18619: Improper Neutralization of Special Elements used in an SQL Command

internal/advancedcommentsystem/admin.php in Advanced Comment System 1.0 is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query, allowing remote attackers to execute the sqli attack via a URL in the "page" parameter...

CVE-2018-19693: Improper Neutralization of Input During Web Page Generation

An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the title parameter...

CVE-2018-19692: Unrestricted Upload of File with Dangerous Type

An issue was discovered in tp5cms through 2017-05-25. admin.php/upload/picture.html allows remote attackers to execute arbitrary PHP code by uploading a .php file with the image/jpeg content type...

PT-2018-15038

Name of the Vulnerable Software and Affected Versions tp5cms versions prior to 2017-05-25 Description An issue allows remote attackers to execute arbitrary PHP code by uploading a .php file with the content type set to image/jpeg to the "admin.php/upload/picture.html" endpoint. Recommendations Fo...

PT-2018-15039

Name of the Vulnerable Software and Affected Versions tp5cms versions prior to 2017-05-25 Description An issue was discovered that allows for XSS via the title parameter in the "admin.php/system/set.html" API endpoint. Recommendations For versions prior to 2017-05-25, as a temporary workaround,...

Cross site request forgery (csrf)

sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account...

CVE-2018-19561

sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account...

CVE-2018-19561

Affected software: sikcms version 1.1. Vulnerability: Cross-Site Request Forgery (CSRF) in admin.php?m=Admin&c=Users&a=userAdd that allows an attacker to add an administrator account. Root cause/impact: CSRF enables unauthorized privilege escalation by creating an admin account. Exploitation deta...

CVE-2018-19562: Unrestricted Upload of File with Dangerous Type

An issue was discovered in PHPok 4.9.015. admin.php?c=update&f=unzip allows remote attackers to execute arbitrary code via a "Login Background Program Upgrade Compressed Packet Upgrade" action in which a .php file is inside a ZIP archive...

CVE-2018-19561: Cross-Site Request Forgery (CSRF)

sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account...

PT-2018-15006

Name of the Vulnerable Software and Affected Versions sikcms version 1.1 Description The issue allows for CSRF via the "admin.php?m=Admin&c=Users&a=userAdd" endpoint to add an administrator account. Recommendations For version 1.1, as a temporary workaround, consider disabling access to the...