Cross site scripting

Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting XSS via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and executed...

CVE-2020-25380: Improper Neutralization of Input During Web Page Generation

Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting XSS via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and executed...

CVE-2020-10984

Gambio GX before 4.0.1.0 allows admin/admin.php CSRF...

CVE-2020-10984

Gambio GX (before 4.0.1.0) contains a CSRF vulnerability in admin/admin.php. The CVE entry CVE-2020-10984 documents a cross-site request forgery flaw affecting the admin interface; no explicit remediation is provided in the connected sources. The public references confirm the affected product/ver...

CVE-2020-10984

Gambio GX before 4.0.1.0 allows admin/admin.php CSRF...

CVE-2020-10984: Cross-Site Request Forgery (CSRF)

Gambio GX before 4.0.1.0 allows admin/admin.php CSRF...

CVE-2019-19110

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter...

CVE-2019-19109: Cross-Site Request Forgery (CSRF)

The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF...

CVE-2019-19110: Improper Neutralization of Input During Web Page Generation

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter...

CVE-2019-19111: Improper Neutralization of Input During Web Page Generation

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter...

CVE-2014-8943

Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svnurl parameter...

CVE-2014-8944

Lexiglot through 2014-11-20 allows XSS Reflected via the username, or XSS Stored via the admin.php?page=config installname, intromessage, or newfilecontent parameter...

Sql injection

Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&fromid= or admin.php?page=history&limit= URI...

Cross site scripting

Lexiglot through 2014-11-20 allows XSS Reflected via the username, or XSS Stored via the admin.php?page=config installname, intromessage, or newfilecontent parameter...

Server side request forgery (ssrf)

Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svnurl parameter...

CVE-2014-8941

CVE-2014-8941 affects Lexiglot (PHP translation platform) through 2014-11-20. The issue is a SQL injection vulnerability arising from unsafely built queries in the admin interface, specifically via URLs like admin.php?page=users&from_id= and admin.php?page=history&limit=. Evidence across multiple...

CVE-2014-8943

Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svnurl parameter...

CVE-2014-8943

CVE-2014-8943 affects Lexiglot up to 2014-11-20 and enables a server-side request forgery (SSRF) via the admin.php?page=projects svn_url parameter. The available documents identify the vulnerable component as Lexiglot (PHP-based translation platform) and point to the svn_url parameter as the inje...

CVE-2014-8945

CVE-2014-8945 affects Lexiglot, a PHP-based translation platform. The vulnerability is a command injection in admin.php?page=projects, exploitable through the username and password fields. Multiple sources confirm the issue, noting it affects Lexiglot releases up to and including 2014-11-20. The ...

CVE-2014-8941: Improper Neutralization of Special Elements used in an SQL Command

Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&fromid= or admin.php?page=history&limit= URI...