CVE-2018-18430: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...

CVE-2018-18431: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI...

CVE-2018-18432: Cross-Site Request Forgery (CSRF)

An issue was discovered in DESTOON B2B 7.0. CSRF exists via the admin.php URI in an action=add request...

CVE-2018-18433: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DESTOON B2B 7.0. admin/category.inc.php has XSS via the categorycatname parameter to the admin.php URI...

PT-2018-14467

Name of the Vulnerable Software and Affected Versions PbootCMS versions prior to V1.3.0 Description The issue is related to SQL Injection in the SingleController.php file. It can be exploited by sending POST data to the "admin.php/Single/mod/mcode/1/id/3" API endpoint. Recommendations For version...

PT-2018-14459

Name of the Vulnerable Software and Affected Versions DESTOON B2B version 7.0 Description An issue was discovered in the software, where the categorycatname parameter in the "admin.php" URI is vulnerable to XSS. This occurs in the "admin/category.inc.php" file. Recommendations For DESTOON B2B...

PT-2018-14457

Name of the Vulnerable Software and Affected Versions DESTOON B2B version 7.0 Description An issue exists where XSS is possible via certain text boxes to the "admin.php?moduleid=2&action=add" URI. Recommendations For DESTOON B2B version 7.0, consider restricting access to the admin.php module to...

PT-2018-14456

Name of the Vulnerable Software and Affected Versions DESTOON B2B version 7.0 Description An issue was discovered in the software, where the adminsetting.inc.php file has a cross-site scripting XSS vulnerability via the first text box to the admin.php URI. Recommendations For DESTOON B2B version...

PT-2018-14458

Name of the Vulnerable Software and Affected Versions DESTOON B2B version 7.0 Description An issue exists where CSRF is possible via the "admin.php" URI in an "action=add" request. Recommendations For DESTOON B2B version 7.0, consider implementing CSRF protection mechanisms, such as tokens, to...

PT-2018-14427

Name of the Vulnerable Software and Affected Versions Z-BlogPHP version 1.5.2.1935 Description The issue is related to a stored XSS vulnerability. It occurs in the zb system/function/c system admin.php file via the Content-Type header when uploading image attachments. Recommendations For Z-BlogPH...

CVE-2018-18191

CVE-2018-18191 describes a Cross‑Site Request Forgery (CSRF) vulnerability in Dayrui FineCms 5.4, specifically in /admin.php?c=member&m=edit&uid=1, which allows remote attackers to change the administrator’s password. The connected documents confirm the affected product/version and the vulnerable...

CVE-2018-18082

XSS exists in Waimai Super Cms 20150505 via the fname parameter to the admin.php?m=Food&a=addsave or admin.php?m=Food&a=editsave URI...

Cross site scripting

XSS exists in Waimai Super Cms 20150505 via the fname parameter to the admin.php?m=Food&a=addsave or admin.php?m=Food&a=editsave URI...

CVE-2018-18191: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password...

CVE-2018-18082: Improper Neutralization of Input During Web Page Generation

XSS exists in Waimai Super Cms 20150505 via the fname parameter to the admin.php?m=Food&a=addsave or admin.php?m=Food&a=editsave URI...

PT-2018-14337

Name of the Vulnerable Software and Affected Versions Waimai Super Cms version 20150505 Description A security issue exists due to the presence of a cross-site scripting XSS flaw. This issue can be exploited via the fname parameter in the admin.php?m=Food&a=addsave or admin.php?m=Food&a=editsave...

PT-2018-14353

Name of the Vulnerable Software and Affected Versions FineCms version 5.4 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to modify the administrator's password through the "/admin.php?c=member&m=edit&uid=1" endpoint. Recommendations For FineCms version 5.4, ...

CVE-2018-18069

processforms in the WPML aka sitepress-multilingual-cms plugin through 3.6.3 for WordPress has XSS via any localefilename parameter such as localefilenameen in an authenticated theme-localization.php request to wp-admin/admin.php...

CVE-2018-18069: Improper Neutralization of Input During Web Page Generation

processforms in the WPML aka sitepress-multilingual-cms plugin through 3.6.3 for WordPress has XSS via any localefilename parameter such as localefilenameen in an authenticated theme-localization.php request to wp-admin/admin.php...

CVE-2018-17826

HisiPHP 1.0.8 is vulnerable to CSRF via admin.php/admin/user/adduser.html, enabling an attacker to create an administrator account. This account can then leverage app/common/model/AdminAnnex.php to add .php to the allowed file-upload types list (.jpg, .png, .gif, .jpeg, .ico), facilitating arbitr...