medidata.ch XSS vulnerability

Open Bug Bounty ID: OBB-624093 Description| Value ---|--- Affected Website:| medidata.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-11414

An issue was discovered in BearAdmin 0.5. There is admin/adminlog/index.html?userid= SQL injection because admin\controller\AdminLog.php constructs a MySQL query improperly...

PT-2018-10557

Name of the Vulnerable Software and Affected Versions BearAdmin version 0.5 Description An issue was discovered in BearAdmin where there is a SQL injection vulnerability due to the improper construction of a MySQL query in the admincontrollerAdminLog.php file. This occurs when the user id paramet...

PT-2018-9701

Name of the Vulnerable Software and Affected Versions: PbootCMS version 0.9.8 Description: The issue allows PHP code injection via an IF label in specific endpoints, such as "index.php/About/6.html" or "admin.php/Site/index.html". This is related to the parserIfLabel function in the...

CVE-2018-9307

dsmall v20180320 allows XSS via the pdrsn parameter to public/index.php/home/predeposit/index.html...

CVE-2018-9307

dsmall v20180320 allows XSS via the pdrsn parameter to public/index.php/home/predeposit/index.html...

CVE-2018-9307: Improper Neutralization of Input During Web Page Generation

dsmall v20180320 allows XSS via the pdrsn parameter to public/index.php/home/predeposit/index.html...

PT-2018-18965

Name of the Vulnerable Software and Affected Versions dsmall version v20180320 Description The issue allows for XSS via the pdr sn parameter to the "public/index.php/home/predeposit/index.html" endpoint. Recommendations For version v20180320, avoid using the pdr sn parameter in the affected...

Cross site request forgery (csrf)

dsmall v20180320 allows physical path leakage via a public/index.php/home/predeposit/index.html?pdrsn= request...

CVE-2018-9015: Improper Neutralization of Input During Web Page Generation

dsmall v20180320 allows XSS via the public/index.php/home/predeposit/index.html pdrsn parameter aka the CMS search box...

PT-2018-18780

Name of the Vulnerable Software and Affected Versions dsmall version v20180320 Description The issue allows physical path leakage via a /public/index.php/home/predeposit/index.html?pdr sn= request. Recommendations For dsmall version v20180320, avoid using the pdr sn variable in the...

onecommon.ofo.com XSS vulnerability

Open Bug Bounty ID: OBB-585881 Description| Value ---|--- Affected Website:| onecommon.ofo.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Code injection

dsmall v20180320 has XSS via a crafted street address to public/index.php/home/memberaddress/index.html, which is mishandled at public/index.php/home/memberaddress/edit/addressid/2.html...

CVE-2018-8906: Improper Neutralization of Input During Web Page Generation

dsmall v20180320 has XSS via a crafted street address to public/index.php/home/memberaddress/index.html, which is mishandled at public/index.php/home/memberaddress/edit/addressid/2.html...

CVE-2018-8070

QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI...

PT-2018-18416

Name of the Vulnerable Software and Affected Versions: QCMS version 3.0 Description: The issue is related to an XSS vulnerability. It can be exploited via the title parameter to the "/guest/index.html" URI. Recommendations: For QCMS version 3.0, update to a version that includes a fix for this...

CVE-2018-8070: Improper Neutralization of Input During Web Page Generation

QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI...

ClipBucket <= 4.0.0 Multiple Vulnerabilities

ClipBucket is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oxygenz:clipbucket"; if...

ommf.gov.hu XSS vulnerability

Vulnerable URL: http://www.ommf.gov.hu/index.html?portalon=1menu=204="&Submit4;= Details: Description| Value ---|--- Patched:| Yes, at 02.12.2017 Latest check for patch:| 02.12.2017 06:40 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated V...

WordPress: Arbitrary file deletion in wp-core - guides towards RCE and information disclosure

Vulnerable place 1: wp-admin/post.php $newmeta'thumb' is placed into DB not sanitized directly from user input. case 'editattachment': checkadminreferer'update-post' . $postid; // Don't let these be changed unset$POST'guid'; $POST'posttype' = 'attachment'; // Update the thumbnail filename $newmet...