331 matches found
PT-2018-12816
Name of the Vulnerable Software and Affected Versions PHPCMS version 9 Description The issue allows remote attackers to cause a denial of service, specifically resource consumption, by sending a request to the "api.php?op=checkcode" endpoint with large values for the font size, height, and width...
Design/Logic Flaw
An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request, bypassing the iWAF protection mechanism...
CVE-2018-13865
An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request, bypassing the iWAF protection mechanism...
CVE-2018-13865: Improper Neutralization of Input During Web Page Generation
An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request, bypassing the iWAF protection mechanism...
PT-2018-12232
Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.9 Description An issue exists where XSS is possible via the callback parameter in a "public/api.php" uploadpic request, which bypasses the iWAF protection mechanism. Recommendations For idreamsoft iCMS version 7.0.9...
CVE-2018-9104
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 21.84.5535.0 and earlier, and Mitel ST 14.2, versions GA27 19.49.5200.0 and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient...
CVE-2018-9104
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 21.84.5535.0 and earlier, and Mitel ST 14.2, versions GA27 19.49.5200.0 and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient...
CVE-2018-9104: Improper Neutralization of Input During Web Page Generation
A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 21.84.5535.0 and earlier, and Mitel ST 14.2, versions GA27 19.49.5200.0 and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient...
PT-2018-18853
Name of the Vulnerable Software and Affected Versions Mitel MiVoice Connect versions R1707-PREM SP1 21.84.5535.0 and earlier Mitel ST 14.2 versions GA27 19.49.5200.0 and earlier Description A reflected cross-site scripting XSS attack is possible due to insufficient validation for the "api.php"...
FineCMS v5.2.0 SQL注入
在/finecms/dayrui/controllers/Api.php第45行： template-cron = 0; $GET'page' = max1, int$this-input-get'page'; $params = drstring2arrayurldecode$this-input-get'params'; $params'get' = @jsondecodeurldecode$this-input-get'get', TRUE; $this-template-assign$params; $name = strreplacearray'\', '/', '..',...
CVE-2018-6893
controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering...
CVE-2018-6893: Improper Neutralization of Special Elements used in an SQL Command
controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering...
PT-2018-17808
Name of the Vulnerable Software and Affected Versions FineCms version 5.2.0 Description The issue concerns SQL Injection in the FineCms software. Specifically, the "controllers/member/Api.php" file is affected when a request is made with certain parameters, including 's=member,c=api,m=checktitle'...
PT-2018-17614
Name of the Vulnerable Software and Affected Versions MantisBT version 2.10.0-development before 2018-02-02 Description The issue allows remote attackers to discover the full path via an invalid filter parameter. This is related to a filter ensure valid filter call in current user api.php. The...
CVE-2017-8809
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability...
DEBIAN-CVE-2017-8809
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability...
CVE-2017-8809
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability...
CVE-2017-8809
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability...
CVE-2017-8809
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability...
CVE-2017-8809: Improper Neutralization of Special Elements in Output Used by a Downstream Component
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability...