WUZHI CMS SQL Injection Vulnerability (CNVD-2021-99300)

WUZHI CMS Five Fingers CMS is a high-performance open source content management system that supports LNAMP architecture, suitable for portals, enterprise websites, mobile sites, microsoft promotion. Attackers can use the keywords parameter in coreframe/app/promote/admin/index.php vulnerability fo...

Chikitsa Patient Management System Component Compromise Data Compromise

The vulnerability of the index.php/admin/adduser component of the Chikitsa Patient Management System exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows an attacker, operating remotely, to compromise the confidentiality and integrity of th...

CVE-2021-40669

SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/index.php file...

CVE-2021-40669

SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/index.php file...

CVE-2021-40669

SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/index.php file...

CVE-2021-40669: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/index.php file...

PT-2021-22939

Name of the Vulnerable Software and Affected Versions Wuzhi CMS version 4.1.0 Description A SQL Injection issue exists via the keywords parameter under the coreframe/app/promote/admin/index.php file. This allows for potential exploitation. Recommendations For Wuzhi CMS version 4.1.0, consider...

CVE-2020-19159

Cross Site Request Forgery CSRF in LaikeTui v3 allows remote attackers to execute arbitrary code via the component '/index.php?module=member&action=add'...

CVE-2020-19157

Cross Site Scripting CSS in Wenku CMS v3.4 allows remote attackers to execute arbitrary code via the 'Intro' parameter for the component '/index.php?m=ucenter&a=index'...

CVE-2020-19157

Wenku CMS v3.4 contains a Cross Site Scripting (CSS) vulnerability in the ucenter index component. The flaw allows remote attackers to inject and execute arbitrary code via the Intro parameter in /index.php?m=ucenter&a=index. The NVD entry (CVE-2020-19157) lists CVSS2 base score 4.3 (MEDIUM) with...

CVE-2020-19159: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF in LaikeTui v3 allows remote attackers to execute arbitrary code via the component '/index.php?module=member&action=add'...

CVE-2021-40845: Unrestricted Upload of File with Dangerous Type

The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php. Neither the content nor extension of the uploaded files is checked, allowing execution of PHP code under the /cmd directory...

PT-2021-10297

Name of the Vulnerable Software and Affected Versions: Wenku CMS version 3.4 Description: The issue allows remote attackers to execute arbitrary code via the Intro parameter for the component "/index.php?m=ucenter&a=index". This enables attackers to perform Cross Site Scripting CSS attacks...

PT-2021-22977

Name of the Vulnerable Software and Affected Versions Zenitel AlphaCom XE Audio Server versions through 11.2.3.10 Description The web part of Zenitel AlphaCom XE Audio Server, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at "php/index.php". Neither the content n...

CVE-2021-40373

playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the tabs-information-page of coremainconfig, and then executing that code via the index.php?app=main&inc=corewelcome URI...

CVE-2021-40373

playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the tabs-information-page of coremainconfig, and then executing that code via the index.php?app=main&inc=corewelcome URI...

CVE-2021-40373

playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the tabs-information-page of coremainconfig, and then executing that code via the index.php?app=main&inc=corewelcome URI...

CVE-2021-40373

playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the tabs-information-page of coremainconfig, and then executing that code via the index.php?app=main&inc=corewelcome URI...

CVE-2021-38353 Dropdown and scrollable Text <= 2.0 Reflected Cross-Site Scripting

The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the /index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0...

CVE-2021-38353

The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the /index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0...