705 matches found
CVE-2019-16312
s-cms V3.0 has XSS in index.php?type=text via the Sid parameter...
UBUNTU-CVE-2019-15132
Zabbix through 4.4.0alpha1 allows User Enumeration. With login requests, it is possible to enumerate application usernames based on the variability of server responses e.g., the "Login name or password is incorrect" and "No permissions for system access" messages, or just blocking for a number of...
CVE-2019-13978
Ovidentia 8.4.3 has SQL Injection via the id parameter in an index.php?tg=delegat&idx=mem request...
CVE-2019-13969
Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=uiset&m=admin&c=index&a=dogettextcontent&table=lang&field=1 request...
CVE-2019-13472
PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file...
CVE-2017-17972
packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request, aka Open Bug Bounty ID OBB-466362...
CVE-2019-12962
LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header...
CVE-2017-12790
Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state...
CVE-2017-12790
Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state...
CVE-2017-12788
Multiple cross-site scripting XSS vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HTML via the 1 class1 parameter or the 2 anyid parameter...
CVE-2019-11398
Multiple cross-site scripting XSS vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon...
CVE-2019-11450
whatsns 4.0 allows index.php?question/ajaxadd.html title SQL injection...
njiandan-cms cross-site request forgery vulnerability
njiandan-cms is a PHP-based content management system CMS. A cross-site request forgery vulnerability exists in njiandan-cms version 2013-05-23 and earlier. A remote attacker can exploit this vulnerability to add an administrator account with the help of the index.php/admin/usernew URL...
CVE-2019-5725
qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file...
CVE-2018-20601
UCMS 1.4.7 has XSS via the description parameter in an index.php listeditpost action...
CVE-2018-20567
An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic circumstances in which install.lock cannot be read...
GreenCMS Cross-Site Request Forgery Vulnerability (CNVD-2019-00334)
GreenCMS is a content management system CMS based on ThinkPHP. A cross-site request forgery vulnerability exists in GreenCMS version 2.3.0603. A remote attacker can exploit this vulnerability to delete log files with the help of the index.php?m=admin&c=data&a=clear URI...
CVE-2018-18774
CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter...
PT-2018-3687 · Centos · Centos Web Panel
Name of the Vulnerable Software and Affected Versions: CentOS Web Panel versions 0.9.8.740 and earlier Description: The issue is related to the failure to protect the web page structure, which can be exploited by a remote attacker to impact the confidentiality and integrity of protected...