CVE-2026-85378 light0011 cms Chapter Controller ChapterController.class.php _initialize authorization

A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. Th...

CVE-2025-12920: Improper Neutralization of Input During Web Page Generation

A flaw has been found in qianfox FoxCMS up to 1.2.16. Affected by this vulnerability is the function add/edit of the file app/admin/controller/Product.php. This manipulation of the argument Title causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-56630: Improper Neutralization of Special Elements used in an SQL Command

FoxCMS v1.2.5 and before is vulnerable to SQL Injection via the columnmodel parameter in the app/admin/controller/Column.php file...

CVE-2025-56630

FoxCMS version 1.2.5 and before is vulnerable to SQL Injection due to improper neutralization of special elements in the column_model parameter. The vulnerability is located within the app/admin/controller/Column.php file. An attacker could exploit this flaw to execute unauthorized SQL queries. R...

CVE-2025-7568: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in qianfox FoxCMS up to 1.2.5. It has been classified as critical. Affected is the function batchCope of the file app/admin/controller/Video.php. The manipulation of the argument ids leads to sql injection. It is possible to launch the attack remotely. The exploit has be...

CVE-2025-5108: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in zongzhige ShopXO 6.5.0. It has been rated as critical. This issue affects the function Upload of the file app/admin/controller/Payment.php of the component ZIP File Handler. The manipulation of the argument params leads to unrestricted upload. The attack may be...

PT-2024-7909

Name of the Vulnerable Software and Affected Versions ThinkAdmin versions up to 6.1.67 Description A critical issue was found in the function script of the file /app/admin/controller/api/Plugs.php, related to deserialization weaknesses. The manipulation of the uptoken argument leads to...

CVE-2024-2406: Unrestricted Upload of File with Dangerous Type

A vulnerability, which was classified as critical, was found in Gacjie Server up to 1.0. This affects the function index of the file /app/admin/controller/Upload.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit ha...

CVE-2023-3057: Path Traversal: '../filedir'

A vulnerability was found in YFCMF up to 3.0.4. It has been rated as problematic. This issue affects some unknown processing of the file app/admin/controller/Ajax.php. The manipulation of the argument controllername leads to path traversal: '../filedir'. The attack may be initiated remotely. The...

CVE-2020-25406

app\admin\controller\sys\Uploads.php in lemocms 1.8.x allows users to upload files to upload executable files...

PT-2020-15379

Name of the Vulnerable Software and Affected Versions fastadmin version 1.0.0.20191212 beta fastadmin-tp6 version 1.0 Description The issue allows for SQL injection when a malicious parameter is passed in the URL /admin/ajax/weigh, after a user with administrator rights has logged in. The table...

CVE-2020-21667

In fastadmin-tp6 v1.0, in the file app/admin/controller/Ajax.php the 'table' parameter passed is not filtered so a malicious parameter can be passed for SQL injection...

CVE-2020-21667: Improper Neutralization of Special Elements used in an SQL Command

In fastadmin-tp6 v1.0, in the file app/admin/controller/Ajax.php the 'table' parameter passed is not filtered so a malicious parameter can be passed for SQL injection...

CVE-2019-5310

YUNUCMS 1.1.8 is affected by a cross‑site scripting vulnerability in app/admin/controller/System.php. The issue allows crafted data to be written to the sys.php file, demonstrated by using site_title in an admin/system/basic POST request. This represents an XSS risk as described across multiple s...

CVE-2019-5310: Improper Neutralization of Input During Web Page Generation

YUNUCMS 1.1.8 has XSS in app/admin/controller/System.php because crafted data can be written to the sys.php file, as demonstrated by sitetitle in an admin/system/basic POST request...

CVE-2018-19520: Improper Control of Generation of Code

An issue was discovered in SDCMS 1.6 with PHP 5.x. app/admin/controller/themecontroller.php uses a checkbad function in an attempt to block certain PHP functions such as eval, but does not prevent use of pregreplace 'e' calls, allowing users to execute arbitrary code by leveraging access to admin...

PT-2018-10237

Name of the Vulnerable Software and Affected Versions SDcms version 1.5 Description A cross-site request forgery CSRF issue allows remote attackers to add administrator accounts. This is possible via the "/WWW//app/admin/controller/admincontroller.php" endpoint with parameters such as m=admin,...