EasyCMS Cross-Site Scripting Vulnerability (CNVD-2018-08985)

EasyCMS is a lightweight scalable open source content management system CMS written in PHP. A cross-site scripting vulnerability exists in EasyCMS version 1.3. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the title, keyword, abstract and content...

mcms最新版任意表的任意字段注入+添加管理员+任意数据删除

简要描述： mcms最新版任意表的任意字段注入+添加管理员+任意数据删除 详细说明： 前两天在wooyun提了两个漏洞，一天就确认修复了，而且出了新版本，那我就去官网下个最新（v3.1.1.enterprise）的来看看学习学习吧。 问题一：任意表的任意字段注入 注入一枚：POST /app/user/info.php?m=save&ajax=1 POST中有个参数modelname，这个参数是用来与数据表前缀（TBPRE）拼接需要操作的数据表的表名的，在获得modelname时并没有过滤，因此，在数据表名可就可以进行注入了，当然，可以利用任意表的任意字段来进行注入。...

XDcms Sql Injection 6-10

简要描述： Sql Injection 详细说明： 注入在XDCMS企业管理系统后台的内容编辑处，\system\modules\xdcms\content.php文件： 这次出在编辑处，用到的函数是editsave public function editsave $title=safehtml$POST'title';//第一处注入title字段，safehtml为过滤规则集，可被大写绕过进行注入 $commend=intval$POST'commend'; $username=safehtml$POST'username';//第二处注入username，大写可绕过过滤...

failles dans ProjectBB v0.4.5.1

Sorry it's in French but i don't have the time to translate... It has been published on SecurityTracker to for people who can't read French. Logiciel: ProjectBB v0.4.5.1 Auteur: Benjilenoob E-mail: [email protected] !-------------------! ! II. XSS ! !-------------------!...

CVE-2004-1735

Cross-site scripting XSS vulnerability in the create list option in Sympa 4.1.x and earlier allows remote authenticated users to inject arbitrary web script or HTML via the description field...

CVE-2002-0267

preferences.php in Simple Internet Publishing System SIPS before 0.3.1 allows remote attackers to gain administrative privileges via a linebreak in the "theme" field followed by the Status::admin command, which causes the Status line to be entered into the password file...