1601 matches found
CVE-2018-20603
Lei Feng TV CMS aka LFCMS 3.8.6 allows admin.php?s=/Member/add.html CSRF...
CVE-2018-20571
CVE-2018-20571 affects DamiCMS 6.0.1. An attacker can remotely read arbitrary files by sending a crafted request to admin.php?s=Tpl/Add/id, demonstrated by reading the global configuration file at .\Public\Config\config.ini.php. The underlying issue is an arbitrary file read path handling in the ...
CVE-2018-16633
Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...
Design/Logic Flaw
Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...
CVE-2018-16634
The vulnerability CVE-2018-16634 affects the Pluck CMS v4.7.7. A Cross-Site Request Forgery (CSRF) exists that allows an attacker to perform unauthorized actions via admin.php?action=settings, such as changing site name and email parameters. This is documented in CNVD-2018-25041 (Pluck CSRF vulne...
CVE-2018-16633
Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...
CVE-2018-16633
Pluck v4.7.7 contains a cross-site scripting (XSS) vulnerability that can be triggered via the page title when editing a page (admin.php?action=editpage&page=...). The underlying issue is a lack of proper sanitization/escaping for the title parameter, enabling injection of malicious scripts. The ...
CVE-2018-19853
An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability that allows control over the whole web site via the admin.php/user/add URI because a storekeeper account which is supposed to have only privileges for commodity management can add an...
CVE-2018-19853
An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability that allows control over the whole web site via the admin.php/user/add URI because a storekeeper account which is supposed to have only privileges for commodity management can add an...
CVE-2018-19853
CVE-2018-19853 describes an elevation-of-privilege flaw in hitshop (through 2014-07-15) where a storekeeper account can add an administrator via admin.php/user/add, gaining control of the whole site. Affected component: the web application’s user/add workflow; root cause: storekeeper privileges c...
CVE-2018-19853
An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability that allows control over the whole web site via the admin.php/user/add URI because a storekeeper account which is supposed to have only privileges for commodity management can add an...
CVE-2018-19693
An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the title parameter...
Design/Logic Flaw
An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the title parameter...
Cross site request forgery (csrf)
sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account...
CVE-2018-19561
sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account...
CVE-2018-19561
Affected software: sikcms version 1.1. Vulnerability: Cross-Site Request Forgery (CSRF) in admin.php?m=Admin&c=Users&a=userAdd that allows an attacker to add an administrator account. Root cause/impact: CSRF enables unauthorized privilege escalation by creating an admin account. Exploitation deta...
CVE-2018-19464
Discuz! X3.4 allows XSS via admin.php because admincp/admincpsetting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code...
Code injection
Discuz! X3.4 allows XSS via admin.php because admincp/admincpsetting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code...
CVE-2018-19464
The vulnerability concerns Discuz! X3.4 where an XSS flaw can be triggered via admin.php due to improper handling of the statcode field in admincp/admincp_setting.php and template\default\common\footer.htm. The root cause is mishandling of third-party stats code, enabling injection of arbitrary w...