CVE-2018-15570: Improper Neutralization of Input During Web Page Generation

In waimai Super Cms 20150505, there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter...

CVE-2018-15568: Cross-Site Request Forgery (CSRF)

tp5cms through 2017-05-25 has CSRF via admin.php/category/delete.html...

PT-2018-13096

Name of the Vulnerable Software and Affected Versions waimai Super Cms version 20150505 Description The issue concerns a stored XSS vulnerability. It can be triggered via the /admin.php/Foodcat/editsave API endpoint, specifically through the fcname parameter. Recommendations For waimai Super Cms...

PT-2018-13091

Name of the Vulnerable Software and Affected Versions tp5cms versions prior to 2017-05-25 Description The issue allows for XSS via the q parameter in the "admin.php/article/index.html" API endpoint. Recommendations For versions prior to 2017-05-25, avoid using the q parameter in the...

PT-2018-13093

Name of the Vulnerable Software and Affected Versions tp5cms versions prior to 2017-05-25 Description The issue allows for CSRF via the "admin.php/category/delete.html" endpoint. This can potentially lead to unauthorized actions on the affected system. Recommendations For versions prior to...

PT-2018-12901

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1.4 Description The issue allows a remote authenticated attacker to execute arbitrary SQL commands. This is achieved via the id parameter in the interface/forms admin/forms admin.php file, which is affected by the...

CVE-2018-15198

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user...

CVE-2018-15197

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges...

CVE-2018-15197

CVE-2018-15197 affects OneThink v1.1. A CSRF in admin.php?s=/AuthManager/addToGroup.html could grant administrator privileges, enabling privilege escalation. The issue is described across multiple feeds (NVD/Red Hat/CVEs) as allowing an attacker to endow admin rights; no public exploit details or...

CVE-2018-15198

CVE-2018-15198 affects OneThink v1.1. A CSRF in admin.php?s=/User/add.html can add a user. Exploitation context and impact are described (CVSS2/3: base scores 6.8/8.8; network vector, no auth, user interaction required). No remediation/patch details are provided in the connected documents; no add...

CVE-2018-15198: Cross-Site Request Forgery (CSRF)

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user...

CVE-2018-15197: Cross-Site Request Forgery (CSRF)

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges...

PT-2018-12942

Name of the Vulnerable Software and Affected Versions OneThink version 1.1 Description An issue was discovered that allows for a CSRF vulnerability. The vulnerability can be exploited through the "admin.php?s=/User/add.html" endpoint, which can add a user. Recommendations For OneThink version 1.1...

PT-2018-12941

Name of the Vulnerable Software and Affected Versions OneThink version 1.1 Description A CSRF issue was found in the admin.php?s=/AuthManager/addToGroup.html endpoint, allowing for the potential granting of administrator privileges. Recommendations For OneThink version 1.1, as a temporary...

CVE-2018-14911: Unrestricted Upload of File with Dangerous Type

A file upload vulnerability exists in ukcms v1.1.7 and earlier. The vulnerability is due to the system not strictly filtering the file upload type. An attacker can exploit the vulnerability to upload a script Trojan to admin.php/admin/configset/index/group/upload.html to gain server control by...

PT-2018-12795

Name of the Vulnerable Software and Affected Versions ukcms versions 1.1.7 and earlier Description A file upload issue exists due to insufficient filtering of the file upload type. An attacker can exploit this by uploading a script Trojan to the admin.php/admin/configset/index/group/upload.html...

blog.seniorennet.nl XSS vulnerability

Open Bug Bounty ID: OBB-648249 Description| Value ---|--- Affected Website:| blog.seniorennet.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-14069

SRCMS V2.3.1 contains a CSRF flaw that allows an attacker to add a user account via admin.php?m=Admin&c=member&a=add. The affected component is the user-management functionality; the root cause is a CSRF vulnerability in the request handling for adding members. Impact statements in the sources in...

CVE-2018-14068: Cross-Site Request Forgery (CSRF)

An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add an admin account via admin.php?m=Admin&c=manager&a=add...

CVE-2018-14069: Cross-Site Request Forgery (CSRF)

An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add a user account via admin.php?m=Admin&c=member&a=add...