1601 matches found
Sandoba CP:Shop CMS 2016.1 Cross Site Scripting
Document Title: =============== Sandoba CP:Shop CMS v2016.1 - Multiple Cross Site Scripting Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2122 Release Date: ============= 2018-03-02 Vulnerability Laboratory ID VL-ID:...
Design/Logic Flaw
The management panel in Piwigo 2.9.3 has stored XSS via the virtualname parameter in a /admin.php?page=catlist request, a different issue than CVE-2017-9836. CSRF exploitation, related to CVE-2017-10681, may be possible...
CVE-2018-7723
CVE-2018-7723 affects Piwigo 2.9.3: a stored XSS in the admin panel via the virtual_name parameter in /admin.php?page=cat_list (distinct from CVE-2017-9836). The description notes CSRF exploitation may be possible, related to CVE-2017-10681. CVSS vectors are provided (3.5/LOW for CVSS2, 5.4/MEDIU...
Sandoba CP:Shop CMS v2016.1 - Multiple XSS Vulnerabilities
Document Title: =============== Sandoba CP:Shop CMS v2016.1 - Multiple XSS Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2122 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-13001 CVE-ID: ======= CVE-2018-13001 Release Date:...
Cross site scripting
controllers/admin/Linkage.php in dayrui FineCms 5.3.0 has Cross Site Scripting XSS via the id or lid parameter in a c=linkage,m=import request to admin.php, because the xssclean protection mechanism is defeated by crafted input that lacks a '' character...
Sql injection
Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator...
CVE-2018-7219
application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...
Cross site request forgery (csrf)
application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...
CVE-2018-7219
application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...
WordPress responsive-coming-soon-page plugin cross-site scripting vulnerability (CNVD-2018-01255)
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . responsive-coming-soon-page plugin is used in one of the test system maintenance plugin . A cross-site scriptin...
WordPress responsive-coming-soon-page plugin cross-site scripting vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . responsive-coming-soon-page plugin is used in one of the test system maintenance plugin . A cross-site scriptin...
CVE-2018-5695
The WpJobBoard plugin 4.4.4 for WordPress allows SQL injection via the order or sort parameter to the wpjb-job or wpjb-alerts module, with a request to wp-admin/admin.php...
CVE-2018-5692
Piwigo v2.8.2 has XSS via the tab, to, section, mode, installstatus, and display parameters of the admin.php file...
Design/Logic Flaw
Piwigo v2.8.2 has XSS via the tab, to, section, mode, installstatus, and display parameters of the admin.php file...
CVE-2018-5692
Piwigo v2.8.2 has XSS via the tab, to, section, mode, installstatus, and display parameters of the admin.php file...
CVE-2018-5692
Piwigo v2.8.2 is affected by a cross-site scripting (XSS) vulnerability in admin.php. The issue can be triggered by unsafely handling input in the tab, to, section, mode, installstatus, and display parameters, allowing injection of malicious script. This vulnerability is documented across multipl...
CVE-2018-5692
Piwigo v2.8.2 has XSS via the tab, to, section, mode, installstatus, and display parameters of the admin.php file...
CVE-2018-5687
NewsBee (CMS) vulnerability CVE-2018-5687: a stored/reflected XSS is possible via the Company Name field in Settings (admin/admin.php). The description across sources consistently states an XSS vulnerability in NewsBee’s Settings interface. Root cause: improper sanitization/escaping of input in t...