CVE-2020-18438: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose sensitive information, via the title parameter to admin.php...

qinggan phpok 路径遍历漏洞

phpok is a set of enterprise website system developed by Shenzhen锟絪 technology limited company using PHP+MYSQL language. A directory traversal vulnerability exists in phpok version 5.1. The vulnerability can be exploited to disclose sensitive information via the title parameter of admin.php...

Ibtana - Ecommerce Product Addons < 0.2.4 - Reflected Cross-Site Scripting

The plugin does not escape some user input before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues. v alert/XSS/ v 0.2.4 - https://example.com/wp-admin/admin.php?page=ibtana-custom-post-type&posttypeid="+style=animation-name:rotation+onanimationstart=alert/XSS/...

CVE-2021-39349: Improper Neutralization of Input During Web Page Generation

The Author Bio Box WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the /includes/admin/class-author-bio-box-admin.php file which allowed attackers with administrative user access to inject arbitrar...

CVE-2021-39344: Improper Neutralization of Input During Web Page Generation

The KJM Admin Notices WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the /admin/class-kjm-admin-notices-admin.php file which allowed attackers with administrative user access to inject arbitrary w...

CVE-2020-21504

waimai Super Cms 20150505 contains a cross-site scripting XSS vulnerability in the component /admin.php?&m=Public&a=login...

Cross site scripting

waimai Super Cms 20150505 contains a cross-site scripting XSS vulnerability in the component /admin.php?m=Config&a=add...

Cross site scripting

waimai Super Cms 20150505 contains a cross-site scripting XSS vulnerability in the component /admin.php?&m=Public&a=login...

Cross site scripting

waimai Super Cms 20150505 contains a cross-site scripting XSS vulnerability in the component /admin.php/Link/addsave...

CVE-2020-21506

The CVE-2020-21506 entry concerns waimai Super Cms version 20150505 with a cross-site scripting (XSS) vulnerability in the /admin.php?m=Config&a=add component. The root cause described in connected records is improper input handling that allows injected script to run in a victim’s browser. Impact...

CVE-2020-21504

The CVE-2020-21504 entry documents a cross-site scripting (XSS) vulnerability in waimai Super Cms 20150505, originating from the login component at /admin.php?&m=Public&a=login. Exploitation details are not provided in the documents, but multiple sources describe input handling flaws that enable ...

CVE-2020-21505: Improper Neutralization of Input During Web Page Generation

waimai Super Cms 20150505 contains a cross-site scripting XSS vulnerability in the component /admin.php/Link/addsave...

CVE-2020-21504: Improper Neutralization of Input During Web Page Generation

waimai Super Cms 20150505 contains a cross-site scripting XSS vulnerability in the component /admin.php?&m=Public&a=login...

CVE-2020-21506: Improper Neutralization of Input During Web Page Generation

waimai Super Cms 20150505 contains a cross-site scripting XSS vulnerability in the component /admin.php?m=Config&a=add...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges...

CVE-2020-21386

CVE-2020-21386 is a CSRF vulnerability in Maccms 10 affecting the component admin.php/admin/type/info.html. The issue arises from its admin flow failing to verify that requests originate from trusted users, enabling an attacker to gain administrator privileges. The connected documents consistentl...

CVE-2020-21386: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges...

CVE-2020-20514: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF in Maccms v10 via admin.php/admin/admin/del/ids/ .html allows authenticated attackers to delete all users...

CVE-2021-34650

The eID Easy WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the /admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.6...

Cross site scripting

The eID Easy WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the /admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.6...