HackerOne: Open redirect vulnerability in index.php

Summary: Hello Team i would like to report an open redirect on hackerone.com with reference to report 320376. In report 320376 it shows vulnerability i mitigated but still i am able to reproduce it. so all the summary and description remains the same. Redirection is performed by HackerOne website...

CVE-2018-19138

WSTMart 2.0.7 has CSRF via the index.php/admin/staffs/add.html URI...

CVE-2018-19050

MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter...

CVE-2018-19051

MetInfo 6.1.3 is affected by a cross-site scripting (XSS) vulnerability exploitable through the admin/index.php?a=dogetpassword abt_type parameter. The issue is tied to MetInfo’s admin input handling, enabling XSS in the context of the injected parameter. Connected sources consistently reference ...

CVE-2018-18939

An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field...

CVE-2018-18938

An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input field...

Cross site scripting

An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input field...

CVE-2018-18939

An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field...

CVE-2018-18939

An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field...

CVE-2018-18724

An XSS issue was discovered in index.php/admin/category/editcategory?id=73 in YUNUCMS 1.1.5...

CVE-2018-18720

An XSS issue was discovered in index.php/admin/system/basic in YUNUCMS 1.1.5...

CVE-2018-18704

PhpTpoint Pharmacy Management System suffers from a SQL injection vulnerability in the index.php username parameter...

CVE-2018-18711

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=editinfo...

Sql injection

PhpTpoint hospital management system suffers from multiple SQL injection vulnerabilities via the index.php user parameter associated with LOGIN.php, or the rno parameter to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php...

Sql injection

PhpTpoint Pharmacy Management System suffers from a SQL injection vulnerability in the index.php username parameter...

Cross site scripting

An XSS issue was discovered in index.php/admin/category/editcategory?id=73 in YUNUCMS 1.1.5...

Cross site scripting

An XSS issue was discovered in index.php/admin/system/basic in YUNUCMS 1.1.5...

SaltOS Erp Crm 3.1 r8126 - SQL Injection (2)

SaltOS Erp Crm 3.1 r8126 - SQL Injection 2 Exploit Title: SaltOS Erp, Crm 3.1 r8126 - SQL Injection Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.saltos.org/ Software Link:...

CVE-2018-18723

An XSS issue was discovered in index.php/admin/area/editarea/id/110000 in YUNUCMS 1.1.5...

CVE-2018-18723

CVE-2018-18723 is an XSS vulnerability in YUNUCMS 1.1.5, located at index.php/admin/area/editarea/id/110000. The connected documents confirm the affected product/version and the specific vulnerable parameter/path, but do not provide details on the underlying root cause, exploit techniques, or ava...