PT-2018-15007

Name of the Vulnerable Software and Affected Versions PHPok version 4.9.015 Description An issue was discovered that allows remote attackers to execute arbitrary code. This is achieved through the "Login Background Program Upgrade Compressed Packet Upgrade" action, where a .php file is placed...

Code injection

Discuz! X3.4 allows XSS via admin.php because admincp/admincpsetting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code...

CVE-2018-19464

Discuz! X3.4 allows XSS via admin.php because admincp/admincpsetting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code...

CVE-2018-19464

Discuz! X3.4 allows XSS via admin.php because admincp/admincpsetting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code...

CVE-2018-19464

The vulnerability concerns Discuz! X3.4 where an XSS flaw can be triggered via admin.php due to improper handling of the statcode field in admincp/admincp_setting.php and template\default\common\footer.htm. The root cause is mishandling of third-party stats code, enabling injection of arbitrary w...

CVE-2018-19464: Improper Neutralization of Input During Web Page Generation

Discuz! X3.4 allows XSS via admin.php because admincp/admincpsetting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code...

PT-2018-14969

Name of the Vulnerable Software and Affected Versions Discuz! X3.4 Description The issue arises from the mishandling of the statcode field from third-party stats code in admincp/admincp setting.php and templatedefaultcommonfooter.htm, allowing for XSS via admin.php. Recommendations For Discuz!...

Cross site request forgery (csrf)

SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account...

CVE-2018-19318

SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account...

Cross site request forgery (csrf)

SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=gifts&a=update to change goods prices with the super administrator's privileges...

CVE-2018-19318

SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account...

CVE-2018-19319

SRCMS 3.0.0 contains a CSRF vulnerability that allows an attacker to change product prices via admin.php?m=Admin&c=gifts&a=update, exploiting the super administrator’s privileges. The issue arises from lack of proper CSRF protection for admin actions, enabling unauthorized price modification. Doc...

CVE-2018-19318

The CVE-2018-19318 issue affects SRCMS 3.0.0 and is a CSRF vulnerability that can be exploited via admin.php?m=Admin&c=manager&a=update to alter the super administrator’s username and password. Root cause: CSRF on the admin update endpoint allows unauthorized change of credentials. Impact: compro...

CVE-2018-19318: Cross-Site Request Forgery (CSRF)

SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account...

CVE-2018-19319: Cross-Site Request Forgery (CSRF)

SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=gifts&a=update to change goods prices with the super administrator's privileges...

PT-2018-14915

Name of the Vulnerable Software and Affected Versions SRCMS version 3.0.0 Description The issue allows for a CSRF attack via the "admin.php?m=Admin&c=gifts&a=update" API endpoint to change goods prices with the privileges of a super administrator. Recommendations For SRCMS version 3.0.0, as a...

PT-2018-14914

Name of the Vulnerable Software and Affected Versions SRCMS version 3.0.0 Description The issue allows for a CSRF attack via the "admin.php?m=Admin&c=manager&a=update" endpoint to change the username and password of the super administrator account. Recommendations For SRCMS version 3.0.0, update ...

CVE-2018-18380

A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session...

CVE-2018-18380

CVE-2018-18380 affects BigTree (Bigtree) CMS prior to 4.2.24. The admin.php flow accepts a user-supplied PHP session ID after login instead of regenerating a new one, enabling session hijacking (session fixation). Documents indicate this is fixed in 4.2.24; remediation is to upgrade to 4.2.24 or ...

CVE-2018-18380

A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session...