CVE-2018-18579

DedeCMS 5.7 SP2 is affected by a reflected XSS vulnerability in the /member/pm.php endpoint, exploitable via the folder parameter. The vulnerable component is DedeCMS’s web interface; input in the folder parameter can be reflected back to the user, enabling arbitrary script/HTML execution in a us...

PT-2018-14525

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 SP2 Description A reflected XSS issue exists, allowing potential exploitation via the "folder" parameter in the /member/pm.php endpoint. Recommendations For DedeCMS version 5.7 SP2, update to a newer version that contains a...

PT-2018-19159

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.6.3-rev37 Open-Xchange OX App Suite versions 7.8.x prior to 7.8.2-rev40 Open-Xchange OX App Suite version 7.8.3 prior to 7.8.3-rev48 Open-Xchange OX App Suite version 7.8.4 prior to 7.8.4-rev28...

CVE-2018-9998: Exposure of Sensitive Information to an Unauthorized Actor

Open-Xchange OX App Suite before 7.6.3-rev37, 7.8.x before 7.8.2-rev40, 7.8.3 before 7.8.3-rev48, and 7.8.4 before 7.8.4-rev28 include folder names in API error responses, which allows remote attackers to obtain sensitive information via the folder parameter in an "all" action to api/tasks...

CVE-2018-11342

A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to create folders via the destfolder parameter...

Directory traversal

Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter...

CVE-2018-6397

Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter...

CVE-2018-6397: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal exists in the Picture Calendar 3.1.4 component for Joomla! via the list.php folder parameter...

PT-2018-17532

Name of the Vulnerable Software and Affected Versions Joomla! Picture Calendar version 3.1.4 Description A Directory Traversal issue exists in the Picture Calendar component for Joomla!. The issue is related to the folder parameter in the list.php file. Recommendations For version 3.1.4, consider...

Cross-site Scripting (XSS)

symphonycms/symphony-2 is vulnerable to cross-site scripting XSS attacks. A flaw in the template/usererror.missingextension.php allows attackers to inject script through the existing-folder parameter...

CVE-2017-11198: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in /application/lib/ajax/getimage.php in FineCMS through 2017-07-12 allows remote attackers to inject arbitrary web script or HTML via the folder, id, or name parameter...

FineCMS Cross-Site Scripting Vulnerability (CNVD-2017-15545)

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. A cross-site scripting vulnerability exists in the /application/lib/ajax/getimage.php file in FineCMS 2017-07-12 and earlier versions. A remote attacker can exploit the vulnerability to inject...

Cross site scripting

Cross-site scripting XSS vulnerability in template/usererror.missingextension.php in Symphony CMS before 2.6.10 allows remote attackers to inject arbitrary web script or HTML via the existing-folder parameter...

CVE-2017-5542

Cross-site scripting XSS vulnerability in template/usererror.missingextension.php in Symphony CMS before 2.6.10 allows remote attackers to inject arbitrary web script or HTML via the existing-folder parameter...

CVE-2017-5542

Cross-site scripting XSS vulnerability in template/usererror.missingextension.php in Symphony CMS before 2.6.10 allows remote attackers to inject arbitrary web script or HTML via the existing-folder parameter...

CVE-2017-5542

Cross-site scripting XSS vulnerability in template/usererror.missingextension.php in Symphony CMS before 2.6.10 allows remote attackers to inject arbitrary web script or HTML via the existing-folder parameter...

OpenXchange User Enumeration

Hi@all, there is an information disclosure in OpenXchange prior 7.8. An authenticated user can enumerate all imap user folders. If you browse the PoC you get an permission denied error, but the folder’s name is reflected into the page in json format. About Open Xchange: Open-Xchange2 develops,...

Coppermine Photo Gallery Catalog Enumeration Vulnerability

Coppermine Photo Gallery is a web-based album management system. The Coppermine Photo Gallery minibrowser.php script fails to adequately filter the 'folder' parameter, allowing remote attackers to exploit a vulnerability to enumerate directories...

CVE-2015-3923: Exposure of Sensitive Information to an Unauthorized Actor

Coppermine Photo Gallery before 1.5.36 allows remote attackers to enumerate directories via a full path in the folder parameter to minibrowser.php...

PT-2015-6348

Name of the Vulnerable Software and Affected Versions Coppermine Photo Gallery versions prior to 1.5.36 Description The issue allows remote attackers to enumerate directories by providing a full path in the folder parameter to "minibrowser.php" API endpoint. Recommendations For versions prior to...