CVE-2021-40669

SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/index.php file...

PT-2021-22939

Name of the Vulnerable Software and Affected Versions Wuzhi CMS version 4.1.0 Description A SQL Injection issue exists via the keywords parameter under the coreframe/app/promote/admin/index.php file. This allows for potential exploitation. Recommendations For Wuzhi CMS version 4.1.0, consider...

CVE-2021-40669: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/index.php file...

CVE-2020-19159

Cross Site Request Forgery CSRF in LaikeTui v3 allows remote attackers to execute arbitrary code via the component '/index.php?module=member&action=add'...

CVE-2020-19157

Cross Site Scripting CSS in Wenku CMS v3.4 allows remote attackers to execute arbitrary code via the 'Intro' parameter for the component '/index.php?m=ucenter&a=index'...

CVE-2020-19157

Wenku CMS v3.4 contains a Cross Site Scripting (CSS) vulnerability in the ucenter index component. The flaw allows remote attackers to inject and execute arbitrary code via the Intro parameter in /index.php?m=ucenter&a=index. The NVD entry (CVE-2020-19157) lists CVSS2 base score 4.3 (MEDIUM) with...

CVE-2020-19159: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF in LaikeTui v3 allows remote attackers to execute arbitrary code via the component '/index.php?module=member&action=add'...

CVE-2021-40845: Unrestricted Upload of File with Dangerous Type

The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php. Neither the content nor extension of the uploaded files is checked, allowing execution of PHP code under the /cmd directory...

PT-2021-10297

Name of the Vulnerable Software and Affected Versions: Wenku CMS version 3.4 Description: The issue allows remote attackers to execute arbitrary code via the Intro parameter for the component "/index.php?m=ucenter&a=index". This enables attackers to perform Cross Site Scripting CSS attacks...

PT-2021-22977

Name of the Vulnerable Software and Affected Versions Zenitel AlphaCom XE Audio Server versions through 11.2.3.10 Description The web part of Zenitel AlphaCom XE Audio Server, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at "php/index.php". Neither the content n...

CVE-2021-40373

playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the tabs-information-page of coremainconfig, and then executing that code via the index.php?app=main&inc=corewelcome URI...

CVE-2021-40373

playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the tabs-information-page of coremainconfig, and then executing that code via the index.php?app=main&inc=corewelcome URI...

CVE-2021-40373

playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the tabs-information-page of coremainconfig, and then executing that code via the index.php?app=main&inc=corewelcome URI...

CVE-2021-40373

playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the tabs-information-page of coremainconfig, and then executing that code via the index.php?app=main&inc=corewelcome URI...

CVE-2021-38353 Dropdown and scrollable Text <= 2.0 Reflected Cross-Site Scripting

The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the /index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0...

CVE-2021-38353

The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the /index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0...

CVE-2021-40373: Improper Control of Generation of Code

playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the tabs-information-page of coremainconfig, and then executing that code via the index.php?app=main&inc=corewelcome URI...

CVE-2021-38353: Improper Neutralization of Input During Web Page Generation

The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the /index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0...

PT-2021-22070

Name of the Vulnerable Software and Affected Versions spideranalyse WordPress plugin version 0.0.1 Description The issue allows attackers to inject arbitrary web scripts via Reflected Cross-Site Scripting, utilizing the date parameter in the /analyse/index.php file. Recommendations For...

PT-2021-22073

Name of the Vulnerable Software and Affected Versions Dropdown and scrollable Text WordPress plugin versions up to and including 2.0 Description The issue allows attackers to inject arbitrary web scripts via the content parameter found in the /index.php file, enabling Reflected Cross-Site Scripti...