CVE-2025-11336: Improper Limitation of a Pathname to a Restricted Directory

A security vulnerability has been detected in Four-Faith Water Conservancy Informatization Platform up to 2.2. Affected by this issue is some unknown functionality of the file /stAlarmConfigure/index.do/../../aloneReport/download.do;otherlogout.do. Such manipulation of the argument fileName leads...

CVE-2025-11018: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in Four-Faith Water Conservancy Informatization Platform 1.0. This affects an unknown function of the file /sysRole/index.do/../../generalReport/download.do;usrlogout.do.do. Executing manipulation of the argument fileName can lead to path traversal. It is possible to launch...

Design/Logic Flaw

JEECMS 9.3 has XSS via an index.do/content/update?type=update URI...

CVE-2018-18952

JEECMS 9.3 has XSS via an index.do/content/update?type=update URI...

CVE-2018-18952

The connected sources confirm CVE-2018-18952 affects JEECMS 9.3 with a cross-site scripting (XSS) vulnerability exploitable via the index.do#/content/update?type=update URI. The underlying issue is an XSS flaw in that endpoint, enabling injected script in user-controlled content. The available do...

CVE-2018-18952: Improper Neutralization of Input During Web Page Generation

JEECMS 9.3 has XSS via an index.do/content/update?type=update URI...

CVE-2010-4841: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ManageEngine EventLog Analyzer 6.1 allow remote attackers to inject arbitrary web script or HTML via the 1 HOSTID, 2 OS, 3 GROUP, 4 exportFile, 5 load, 6 type, or 7 tab parameter to INDEX.do, the 8 reported parameter to INDEX2.do, the 9 gId...