1601 matches found
CVE-2020-29250
CXUUCMS V3 contains a Cross-Site Scripting (XSS) vulnerability that can be triggered via the first and third input fields to /public/admin.php. The issue is documented across multiple connected sources (e.g., Red Hat, CNVD, CVE records) and is described as CXUUCMS V3 allowing XSS through those in...
CVE-2020-35346
CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add...
Cross site request forgery (csrf)
CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add...
Cross site scripting
CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add...
CVE-2020-35347
CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add...
CVE-2020-35346
CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add...
CVE-2020-35346
CXUUCMS V3.1 is affected by a reflected cross-site scripting (XSS) flaw originating from the imgurl parameter in admin.php?c=content&a=add. The vulnerability allows remote attackers to inject arbitrary web script or HTML, as described across multiple sources (NVD, Red Hat, CNVD, CNVD-derived entr...
Code injection
Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of admin.php?reqGadget=Components&reqAction=InstallGadget&comp=FileBrowser and admin.php?reqGadget=FileBrowser&reqAction=Files to upload a .php file. NOTE: this is unrelated to the JAWS aka Job...
CVE-2020-35656
CVE-2020-35656 affects Jaws (CMS) up to version 1.8.0. The vulnerability arises from crafted requests to admin.php?reqGadget=Components&reqAction=InstallGadget&comp=FileBrowser and admin.php?reqGadget=FileBrowser&reqAction=Files, which allow an authenticated administrator to upload a .php file an...
Sql injection
PHPSHE 1.7 has SQL injection via the admin.php?mod=user&userlevelid=1 userlevelid parameter...
CVE-2020-19165
PHPSHE 1.7 has SQL injection via the admin.php?mod=user&userlevelid=1 userlevelid parameter...
CVE-2020-19165
PHPSHE 1.7 is affected by CVE-2020-19165: an SQL injection in the admin.php?mod=user&userlevel_id=1 and userlevel_id[] parameter. The issue originates from unsafely handling userlevel_id input, enabling an attacker to manipulate SQL queries. No remediation details are provided in the connected do...
CVE-2020-25273
In SourceCodester Online Bus Booking System 1.0, there is Authentication bypass on the Admin Login screen in admin.php via username or password SQL injection...
CVE-2020-17551
ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution...
CVE-2020-17551
ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution...
Remote code execution
ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution...
CVE-2020-17551
ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution...
CVE-2020-21564
CVE-2020-21564 concerns Pluck CMS versions 4.7.10-dev2 and 4.7.11, where a file upload vulnerability can lead to remote command execution via the endpoint admin.php?action=files. The sources provided describe the vulnerability but do not specify additional technical details, exploit status, affec...
Cross site scripting
Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting XSS via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and executed...