CVE-2019-14344: Improper Neutralization of Input During Web Page Generation

TemaTres 3.0 has reflected XSS via the replacestring or searchstring parameter to the vocab/admin.php?doAdmin=bulkReplace URI...

CVE-2013-5978

Multiple cross-site scripting XSS vulnerabilities in products.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 Product name or 2 Price description fields via a request to wp-admin/admin.php. NOTE: This issue may on...

CVE-2019-14343

TemaTres 3.0 has stored XSS via the value parameter to the vocab/admin.php?vocabularioid=list URI...

Cross site scripting

TemaTres 3.0 has stored XSS via the value parameter to the vocab/admin.php?vocabularioid=list URI...

CVE-2019-14343: Improper Neutralization of Input During Web Page Generation

TemaTres 3.0 has stored XSS via the value parameter to the vocab/admin.php?vocabularioid=list URI...

CVE-2019-17593

CVE-2019-17593 affects JIZHICMS 1.5.1, where a CSRF flaw in admin.php/Admin/adminadd.html can be exploited to add an administrator. Multiple sources (NVD, RH, CNVD, OSV, CVE lists) corroborate that this is a cross‑site request forgery vulnerability in JIZHICMS 1.5.1. The CVSS data from NVD indica...

CVE-2019-17580

tonyy dormsystem through 1.3 allows SQL Injection in admin.php...

Sql injection

tonyy dormsystem through 1.3 allows SQL Injection in admin.php...

CVE-2019-17580

The CVE-2019-17580 entry corresponds to Tooonyy dormsystem prior to or at version 1.3, where a SQL injection vulnerability exists in admin.php due to lack of validation of externally-entered SQL statements. The connected records (CNVD-2020-14283, RH: CVE-2019-17580, OSV and CVE listings) corrobor...

CVE-2019-17580

tonyy dormsystem through 1.3 allows SQL Injection in admin.php...

CVE-2019-17593: Cross-Site Request Forgery (CSRF)

JIZHICMS 1.5.1 allows admin.php/Admin/adminadd.html CSRF to add an administrator...

CVE-2019-17580: Improper Neutralization of Special Elements used in an SQL Command

tonyy dormsystem through 1.3 allows SQL Injection in admin.php...

CVE-2019-17417

PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs...

PbootCMS Cross-Site Scripting Vulnerability

PbootCMS is a new core open source enterprise building system developed by Avantech. A cross-site scripting vulnerability exists in PbootCMS 2.0.2, which can be exploited to conduct cross-site scripting attacks via routes involving Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URI...

CVE-2019-17417

PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs...

CVE-2019-17417: Improper Neutralization of Input During Web Page Generation

PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs...

CVE-2015-9452: Improper Neutralization of Special Elements used in an SQL Command

The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nexformsId parameter...

CVE-2015-9454: Improper Neutralization of Special Elements used in an SQL Command

The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin currentsliderid parameter...

CVE-2015-9442

The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenirplugin...

CVE-2015-9448

The CVE-2015-9448 issue affects the WordPress SendPress plugin (versions prior to 1.2). The vulnerability is an SQL Injection in the wp-admin/admin.php?page=sp-queue listid parameter. Impact per sources includes manipulation/exfiltration of data via the web interface, with CVSS scores indicating ...