CVE-2018-18380: Session Fixation

A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session...

CVE-2018-18486

An issue was discovered in PHPSHE 1.7. SQL injection exists via the admin.php?mod=user&act=del userid parameter...

Sql injection

An issue was discovered in PHPSHE 1.7. SQL injection exists via the admin.php?mod=user&act=del userid parameter...

CVE-2018-18486

An issue was discovered in PHPSHE 1.7. SQL injection exists via the admin.php?mod=user&act=del userid parameter...

Design/Logic Flaw

XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page request...

CVE-2018-18486: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in PHPSHE 1.7. SQL injection exists via the admin.php?mod=user&act=del userid parameter...

CVE-2018-18485: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in PHPSHE 1.7. admin.php?mod=db&act=del allows remote attackers to delete arbitrary files via directory traversal sequences in the dbname parameter. This can be leveraged to reload the product by deleting install.lock...

PT-2018-14485

Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description An issue was discovered that allows remote attackers to delete arbitrary files via directory traversal sequences in the dbname parameter in the "admin.php?mod=db&act=del" API endpoint. This can be leveraged to...

PT-2018-14486

Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description An issue exists in the software, allowing SQL injection via the "admin.php?mod=user&act=del" API endpoint, specifically through the user id parameter. Recommendations For PHPSHE version 1.7, avoid using the user ...

CVE-2018-18430

An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...

CVE-2018-18431

An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI...

CVE-2018-18432

An issue was discovered in DESTOON B2B 7.0. CSRF exists via the admin.php URI in an action=add request...

Cross site request forgery (csrf)

An issue was discovered in DESTOON B2B 7.0. CSRF exists via the admin.php URI in an action=add request...

Design/Logic Flaw

An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...

CVE-2018-18430

An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...

CVE-2018-18431

An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI...

CVE-2018-18432

An issue was discovered in DESTOON B2B 7.0. CSRF exists via the admin.php URI in an action=add request...

CVE-2018-18431

DESTOON B2B 7.0 contains a cross-site scripting (XSS) vulnerability exposed via text boxes when visiting admin.php?moduleid=2&action=add. The CVE entry and CNVD/NVD variants describe the same issue, with no explicit details on affected build flavors beyond version 7.0 and the vulnerable input poi...

CVE-2018-18432

Summary: DESTOON B2B 7.0 is affected by a CSRF vulnerability that can be exploited via the admin.php URI with an action=add request. Multiple sources (NVD entry CVE-2018-18432 and CNVD/NVD references) confirm a CSRF flaw in DESTOON B2B 7.0. The CVSS metrics indicate a network-based, high-severity...

CVE-2018-18450: Improper Neutralization of Special Elements used in an SQL Command

apps\admin\controller\content\SingleController.php in PbootCMS before V1.3.0 build 2018-11-12 has SQL Injection, as demonstrated by the POST data to the admin.php/Single/mod/mcode/1/id/3 URI...