Cross-Site Scripting in Form Engine

It has been discovered that HTML placeholder attributes containing data of other database records are vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability...

Same-Origin Request Forgery to Backend User Interface

It has been discovered that the backend user interface and install tool are vulnerable to same-origin request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to the web server - scripts are then executed with the privilege...

Information disclosure

In Shopizer before version 2.11.0, a script can be injected in various forms and saved in the database, then executed when information is fetched from backend. This has been patched in version 2.11.0...

SQL injection vulnerability in zzcms backend in***.php file (CNVD-2020-32329)

zzcms is a free website builder developed in asp language. SQL injection vulnerability exists in zzzcms background in.php file. Attackers can use the vulnerability to obtain sensitive information in the database...

Basecamp: Unauthenticated request smuggling on launchpad.37signals.com

Description By sending an ambiguous request on the rails application on launchpad.37signals.com, an attacker can desynchronise frontend and backend servers, leaving the socket to the backend server poisoned with a harmful response. This response will then be served up to the next visitor. The...

Code execution vulnerability in imcat backend

Intimate cat imcat is a PHP + MySQL architecture and design of a general-purpose website system, simple, lightweight, practical, sharing, permanent open source free of charge. imcat backend code execution vulnerabilities exist. Attackers can exploit the vulnerability to execute arbitrary code...

File upload vulnerability in imcat backend

Intimate cat imcat is a PHP + MySQL architecture and design of a general-purpose website system, simple, lightweight, practical, sharing, permanent open source free of charge. There is a file upload vulnerability in the imcat backend. Attackers can use this vulnerability to upload webshell, get...

Multiple SQL Injection Vulnerabilities in YIXUNCMS Backend

YIXUNCMS is a showcase website system developed by Yixun Software Studio for small and medium-sized enterprises, using PHP language and with a stable MYSQL database. YIXUNCMS background there are multiple SQL injection vulnerabilities. Attackers can use the vulnerability to obtain sensitive...

SQL execution vulnerability in imcat backend

Intimate cat imcat is a PHP + MySQL architecture and design of a general-purpose website system, simple, lightweight, practical, sharing, permanent open source free of charge. There is a SQL execution vulnerability in the imcat backend. Attackers can use the vulnerability to obtain sensitive...

evolution security and bug fix update

evolution 3.28.5-12 - Add patch for RH bug 1778799 New Mail account wizard ignores email address change 3.28.5-11 - Update patch for RH bug 1764563 CVE-2018-15587: Reposition signature bar 3.28.5-10 - Add patch for RH bug 1764563 CVE-2018-15587: Reposition signature bar - Add patch for RH bug...

Backend File Upload Vulnerability in phpSQLiteCMS

phpSQLiteCMS is an open source web content management system based on PHP and SQLite. A backend file upload vulnerability exists in phpSQLiteCMS, which can be exploited by attackers to gain control of a web server...

Design/Logic Flaw

IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue...

Design/Logic Flaw

On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a specially crafted HTTP request can lead to reflected XSS after the BIG-IP APM system rewrites the HTTP response from the untrusted backend server and sends it to the client...

CVE-2020-5889

On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a specially crafted HTTP request can lead to reflected XSS after the BIG-IP APM system rewrites the HTTP response from the untrusted backend server and sends it to the client...

Privilege Escalation

gvfs is vulnerable to privilege escalation. A race condition in daemon/gvfsbackendadmin.c allows escalation of privileges due to admin backend not implementing queryinfoonread/write...

Code execution vulnerability in ejucms backend

EJU real estate system ejucms is a set of localized O2O real estate website platform system. Code execution vulnerabilities exist in the background of ejucms, attackers can exploit the vulnerability to execute malicious code to obtain server privileges...

F5 Networks BIG-IP : TMM vulnerability (K43450419)

Undisclosed requests can lead to a denial of service DoS when sent to BIG-IP HTTP/2 virtual servers. The problem can occur when ciphers, which have been blacklisted by the HTTP/2 RFC, are used on backend servers. This is a data-plane issue. There is no control-plane exposure. CVE-2020-5871 Impact...

Command execution vulnerability in EyouCms backend (CNVD-2020-28132)

eyoucms is an enterprise website building system that focuses on enterprise website construction. A command execution vulnerability exists in the EyouCms backend, which can be exploited by attackers to execute malicious commands to gain server privileges...

F5 Networks BIG-IP : BIG-IP APM portal access reflected XSS vulnerability (K24415506)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.2.4 / 15.0.1.3 / 15.1.0.2. It is, therefore, affected by a vulnerability as referenced in the K24415506 advisory. - On versions 15.1.0-15.1.0.1, 15.0.0-15.0.1.2, and 14.1.0-14.1.2.3, in BIG-IP APM portal access, a...

gvfs: race condition in daemon/gvfsbackendadmin.c due to admin backend not implementing query_info_on_read/write

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement queryinfoonread/write...