CVE-2018-6618: Insufficiently Protected Credentials

Easy Hosting Control Panel EHCP v0.37.12.b allows attackers to obtain sensitive information by leveraging cleartext password storage...

CVE-2018-6617: Improper Authentication

Easy Hosting Control Panel EHCP v0.37.12.b, when using a local MySQL server, allows attackers to change passwords of arbitrary database users by leveraging failure to ask for the current password...

PT-2018-17671

Name of the Vulnerable Software and Affected Versions Easy Hosting Control Panel EHCP version 0.37.12.b Description The issue allows attackers to change passwords of arbitrary database users when using a local MySQL server. This is due to the failure to ask for the current password, which enables...

PT-2018-17672

Name of the Vulnerable Software and Affected Versions Easy Hosting Control Panel EHCP version 0.37.12.b Description The issue allows attackers to obtain sensitive information by leveraging cleartext password storage. Recommendations For Easy Hosting Control Panel EHCP version 0.37.12.b, consider...

PT-2018-17504

Name of the Vulnerable Software and Affected Versions Easy Hosting Control Panel EHCP version 0.37.12.b Description The issue allows for XSS via the op parameter. This can be exploited by adding a backdoor FTP account. Recommendations For Easy Hosting Control Panel EHCP version 0.37.12.b, avoid...

CVE-2018-6362: Improper Neutralization of Input During Web Page Generation

Easy Hosting Control Panel EHCP v0.37.12.b has XSS via the domainop action parameter, as demonstrated by reading the PHPSESSID cookie...

PT-2018-17556

Name of the Vulnerable Software and Affected Versions Easy Hosting Control Panel EHCP version 0.37.12.b Description The issue allows remote attackers to conduct cross-site request forgery CSRF attacks due to a lack of CSRF protection. Recommendations For Easy Hosting Control Panel EHCP version...

CVE-2018-6619: Use of a Broken or Risky Cryptographic Algorithm

Easy Hosting Control Panel EHCP v0.37.12.b makes it easier for attackers to crack database passwords by leveraging use of a weak hashing algorithm without a salt...

CVE-2018-6361: Improper Neutralization of Input During Web Page Generation

Easy Hosting Control Panel EHCP v0.37.12.b has XSS via the op parameter, as demonstrated by adding a backdoor FTP account...

CVE-2018-6458: Cross-Site Request Forgery (CSRF)

Easy Hosting Control Panel EHCP v0.37.12.b allows remote attackers to conduct cross-site request forgery CSRF attacks by leveraging lack of CSRF protection...

idreamsoft iCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-09388)

idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in idreamsoft iCMS version 7.0. A remote attacker can add Column with the help of /admincp.php?app=articlecategory&do=save&frame=iPHP to exploit the...

Easy Hosting Control Panel 0.37.12.b Cross Site Scripting Add FTP Account

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-XSS-FTP-BACKDOOR-ACCOUNT.txt + ISR: Apparition Security Greetz: indoushka|Eduardo|Dirty0tis Vendor: ============= www.ehcp.net Product: =========== Easy Hosting Control...

Easy Hosting Control Panel 0.37.12.b Cross Site Request Forgery

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-MULTIPLE-CSRF.txt + ISR: Apparition Security Greetz: indoushka|Eduardo|Dirty0tis Vendor: ======== www.ehcp.net Product: ========= Easy Hosting Control Panel v0.37.12.b Ehcp...

Vesta Control Panel Cross-Site Scripting Vulnerability (CNVD-2018-09183)

Vesta Control Panel is an open source web hosting control panel. A cross-site scripting vulnerability exists in Vesta Control Panel version 0.9.8-20. A remote attacker can exploit this vulnerability by sending the 'path' parameter to the view/file/index.php URI to execute PHP code...

CVE-2018-10686

An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $REQUEST'path' to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a fileputcontents call in web/upload/UploadHandler.php...

Cross site scripting

An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $REQUEST'path' to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a fileputcontents call in web/upload/UploadHandler.php...

CVE-2018-10686

An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $REQUEST'path' to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a fileputcontents call in web/upload/UploadHandler.php...

CVE-2018-10686

An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $REQUEST'path' to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a fileputcontents call in web/upload/UploadHandler.php...

CVE-2018-10686

An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $REQUEST'path' to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a fileputcontents call in web/upload/UploadHandler.php...

CVE-2018-10686

Vesta Control Panel 0.9.8-20 is affected by a Reflected XSS vulnerability in the view/file/index.php path, exploitable via the $_REQUEST['path'] parameter. The issue can lead to remote PHP code execution through a file_put_contents call in web/upload/UploadHandler.php. This vulnerability is surfa...