CVE-2020-19886

DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for an /index.php?dbhcmspid=-80&deletemenu=9 can delete any menu...

CVE-2020-19886

DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for an /index.php?dbhcmspid=-80&deletemenu=9 can delete any menu...

CVE-2020-19886

CVE-2020-19886 : DBHcms v1.2.0 is vulnerable to Cross-Site Request Forgery due to missing CSRF protection. The vulnerability is demonstrated by a CSRF request to /index.php?dbhcms_pid=-80&deletemenu=9 that can delete a menu item. Multiple connected sources confirm the issue; no remediation or pat...

CVE-2020-19885

DBHcms v1.2.0 is affected by a stored XSS vulnerability in dbhcms/mod/mod.page.edit.php line 227 due to missing htmlspecialchars handling for $_POST['pageparam_insert_name']. Exploitation requires an authenticated admin user, which could allow hijacking other users. The available connected docume...

CVE-2020-19885

DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for '$POST'pageparaminsertname'' variable in dbhcms\mod\mod.page.edit.php line 227, A remote authenticated with admin user can exploit this vulnerability to hijack other users...

CVE-2020-19885

DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for '$POST'pageparaminsertname'' variable in dbhcms\mod\mod.page.edit.php line 227, A remote authenticated with admin user can exploit this vulnerability to hijack other users...

CVE-2020-19884

CVE-2020-19884 affects DBHcms v1.2.0. The vulnerability is a stored XSS caused by missing htmlspecialchars() in dbhcms\mod\mod.domain.edit.php line 119. Impact described as stored XSS with potential to inject script when handling untrusted input; exploitation details are not provided in the suppl...

CVE-2020-19884

DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function in dbhcms\mod\mod.domain.edit.php line 119...

CVE-2020-19884

DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function in dbhcms\mod\mod.domain.edit.php line 119...

CVE-2020-19883

DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter in dbhcms\mod\mod.users.view.php line 57 for userlogin, A remote authenticated with admin user can exploit this vulnerability to hijack other users...

CVE-2020-19883

DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter in dbhcms\mod\mod.users.view.php line 57 for userlogin, A remote authenticated with admin user can exploit this vulnerability to hijack other users...

CVE-2020-19883

CVE-2020-19883 affects DBHcms v1.2.0 with a stored cross-site scripting vulnerability due to a missing security filter in dbhcms/mod/mod.users.view.php line 57 (user_login). The vulnerability allows an authenticated admin to hijack other users, as described in multiple connected sources. Exploita...

CVE-2020-19882

DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for 'menudescription' variable in dbhcms\mod\mod.menus.edit.php line 83 and in dbhcms\mod\mod.menus.view.php line 111, A remote authenticated with admin user can exploit this vulnerability to hijack other users...

CVE-2020-19882

DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for 'menudescription' variable in dbhcms\mod\mod.menus.edit.php line 83 and in dbhcms\mod\mod.menus.view.php line 111, A remote authenticated with admin user can exploit this vulnerability to hijack other users...

CVE-2020-19882

CVE-2020-19882 affects DBHcms v1.2.0. A stored XSS vulnerability exists due to missing htmlspecialchars handling for the ‘menu_description’ variable in the code paths dbhcms/mod/mod.menus.edit.php (line 83) and dbhcms/mod/mod.menus.view.php (line 111). The issue could allow a remote attacker auth...

CVE-2020-19877

DBHcms v1.2.0 has a directory traversal vulnerability as there is no directory control function in directory /dbhcms/. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information...

CVE-2020-19877

DBHcms v1.2.0 has a directory traversal vulnerability as there is no directory control function in directory /dbhcms/. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information...

Directory traversal

DBHcms v1.2.0 has a directory traversal vulnerability as there is no directory control function in directory /dbhcms/. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information...

CVE-2020-19881

DBHcms v1.2.0 has a reflected xss vulnerability as there is no security filter in dbhcms\mod\mod.selector.php line 108 for $GET'returnname' parameter, A remote authenticated with admin user can exploit this vulnerability to hijack other users...

CVE-2020-19881

DBHcms v1.2.0 contains a reflected XSS vulnerability due to lack of input filtering on the $_GET['return_name'] parameter in dbhcms/mod/mod.selector.php (line 108). A remote attacker authenticated as an admin can exploit this to hijack other users. Affected component: DBHcms 1.2.0; Root cause: mi...