CVE-2018-17826: Cross-Site Request Forgery (CSRF)

HisiPHP 1.0.8 allows CSRF via admin.php/admin/user/adduser.html to add an administrator account. The attacker can then use that account to execute arbitrary PHP code by leveraging app/common/model/AdminAnnex.php to add .php to the default list of allowable file-upload types .jpg, .png, .gif, .jpe...

PT-2018-14206

Name of the Vulnerable Software and Affected Versions HisiPHP version 1.0.8 Description The issue allows for a CSRF attack via the "admin.php/admin/user/adduser.html" API endpoint to add an administrator account. An attacker can then use this account to execute arbitrary PHP code by modifying the...

PT-2018-13920

Name of the Vulnerable Software and Affected Versions Quizlord plugin versions prior to 2.1 Description The issue allows for Stored XSS attacks through the title parameter in a ql insert action to "wp-admin/admin.php". Recommendations For Quizlord plugin versions prior to 2.1, update to version 2...

CVE-2018-17140: Improper Neutralization of Input During Web Page Generation

The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a qlinsert action to wp-admin/admin.php...

CVE-2018-16729

Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages-manage under admin.php?action=files...

CVE-2018-16729

Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages-manage under admin.php?action=files...

CVE-2018-16729

Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages-manage under admin.php?action=files...

CVE-2018-16729

Pluck CMS 4.7.7 is vulnerable to cross-site scripting via an SVG file containing Javascript in a SCRIPT element, uploaded through pages->manage under admin.php?action=files. The flaw is caused by how SVGs are handled, enabling XSS. Exploitation details are not provided in the documents; no pat...

CVE-2018-16729: Improper Neutralization of Input During Web Page Generation

Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages-manage under admin.php?action=files...

PT-2018-13706

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.7 Description The issue allows for XSS Cross-Site Scripting attacks via an SVG file containing Javascript in a SCRIPT element. This file can be uploaded through the 'pages-manage' section under the 'admin.php?action=files'...

bloggen.be XSS vulnerability

Open Bug Bounty ID: OBB-674630 Description| Value ---|--- Affected Website:| bloggen.be Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Cross site request forgery (csrf)

\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftpsave...

CVE-2018-16732

\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftpsave...

CVE-2018-16732: Cross-Site Request Forgery (CSRF)

\upload\plugins\sys\admin\Setting.php in CScms 4.1 allows CSRF via admin.php/setting/ftpsave...

PT-2018-13710

Name of the Vulnerable Software and Affected Versions CScms version 4.1 Description The issue concerns a CSRF vulnerability in the Setting.php file within the CScms software. This vulnerability can be exploited via the "admin.php/setting/ftp save" endpoint. Recommendations For CScms version 4.1,...

CVE-2018-15474: Improper Neutralization of Formula Elements in a CSV File

CSV Injection aka Excel Macro Injection or Formula Injection in /lib/plugins/usermanager/admin.php in DokuWiki 2018-04-22a and earlier allows remote attackers to exfiltrate sensitive data and to execute arbitrary code via a value that is mishandled in a CSV export. NOTE: the vendor has stated "th...

CVE-2018-16449

CVE-2018-16449 affects OneThink 1.1.141212, enabling cross-site request forgery (CSRF) to perform admin actions: adding a page (admin.php?s=/Channel/add.html), adding a blog (admin.php?s=/Article/update.html), and changing audit state (admin.php?s=/Article/setStatus/status/1.html). The connected ...

CVE-2018-16448: Cross-Site Request Forgery (CSRF)

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

CVE-2018-16449: Cross-Site Request Forgery (CSRF)

OneThink 1.1.141212 allows CSRF for adding a page via admin.php?s=/Channel/add.html, adding a blog via admin.php?s=/Article/update.html, and setting the audit state via admin.php?s=/Article/setStatus/status/1.html...

PT-2018-13575

Name of the Vulnerable Software and Affected Versions Cscms version 4 Description The issue allows for CSRF attacks, enabling unauthorized actions such as creating a member, authenticating vip members, creating a super administrator, and creating a web editor through specific API endpoints:...