144 matches found
CVE-2018-16356
An issue was discovered in PbootCMS. There is a SQL injection via the api.php/List/index order parameter...
Sql injection
An issue was discovered in PbootCMS. There is a SQL injection via the api.php/Cms/search order parameter...
Sql injection
An issue was discovered in PbootCMS. There is a SQL injection via the api.php/List/index order parameter...
CVE-2018-16357
An issue was discovered in PbootCMS. There is a SQL injection via the api.php/Cms/search order parameter...
CVE-2018-16357
The CVE-2018-16357 entry concerns PbootCMS and a SQL injection vulnerability exposed through the api.php/Cms/search order parameter. The NVD entry documents a SQL injection path in PbootCMS, with CVSS v3.1 impact scores: {C:H, I:H, A:H} and a base score of 9.8 (CRITICAL) and CVSS v2 base score 7....
CVE-2018-16356
An issue was discovered in PbootCMS. There is a SQL injection via the api.php/List/index order parameter...
MediaWiki Reflected Cross-Site Scripting (CVE-2017-8809)
A reflected cross-site scripting vulnerability exists in MediaWiki. The vulnerability is due to insufficient input validation on user input in the api.php component. A remote user can exploit this vulnerability by enticing a user to click on a malicious link...
CVE-2013-1817
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information...
CVE-2013-1817
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information...
CVE-2013-1817
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information...
CVE-2013-1817
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information...
Cross site scripting
An XSS issue was discovered in app/search/search.app.php in idreamsoft iCMS 7.0.14 via the public/api.php?app=search q parameter...
CVE-2019-11427
The CVE-2019-11427 entry concerns an XSS vulnerability in idreamsoft iCMS 7.0.14, exploitable via the public/api.php?app=search&q parameter within the file app/search/search.app.php. Connected sources consistently describe the issue as a Cross-Site Scripting vulnerability in iCMS 7.0.14, with no ...
CVE-2019-8902
An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI...
CVE-2018-20006
CVE-2018-20006 affects PHPok v5.0.055. A Stored XSS flaw exists in the title parameter passed to api.php?c=post&f=save, reachable via index.php?id=book. The underlying issue is unencoded user input being stored and subsequently rendered, enabling script execution in a victim’s browser. Public ref...
CVE-2018-18319
An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed on...
CVE-2018-18319
An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed on...
Sql injection
PbootCMS 1.2.1 has SQL injection via the HTTP POST data to the api.php/cms/addform?fcode=1 URI...