13467 matches found
CVE-2020-23691
YFCMF v2.3.1 has a Remote Command Execution RCE vulnerability in the index.php...
CVE-2020-23691
CVE-2020-23691 affects YFCMF v2.3.1. Multiple connected sources describe a Remote Command Execution (RCE) vulnerability in the package’s index.php. The underlying issue enables an attacker to craft a POST request to index.php to execute system commands on the hosting environment. Reported in vari...
CVE-2020-23691
YFCMF v2.3.1 has a Remote Command Execution RCE vulnerability in the index.php...
CVE-2020-23691
YFCMF v2.3.1 has a Remote Command Execution RCE vulnerability in the index.php...
PT-2021-10927
Name of the Vulnerable Software and Affected Versions YFCMF version 2.3.1 Description The issue is related to a Remote Command Execution RCE vulnerability. It affects the index.php file. Recommendations For YFCMF version 2.3.1, at the moment, there is no information about a newer version that...
CVE-2020-23691: Undefined Security Weakness
YFCMF v2.3.1 has a Remote Command Execution RCE vulnerability in the index.php...
CVE-2021-31537
SIS SIS-REWE Go before 7.7 SP17 allows XSS: rewe/prod/web/index.php affected parameters are config, version, win, db, pwd, and user and /rewe/prod/web/rewegocheck.php version and all other parameters...
CVE-2021-31537: Improper Neutralization of Input During Web Page Generation
SIS SIS-REWE Go before 7.7 SP17 allows XSS: rewe/prod/web/index.php affected parameters are config, version, win, db, pwd, and user and /rewe/prod/web/rewegocheck.php version and all other parameters...
PT-2021-19410
Name of the Vulnerable Software and Affected Versions SIS SIS-REWE Go versions prior to 7.7 SP17 Description The issue allows for XSS attacks. It affects the 'rewe/prod/web/index.php' endpoint, with vulnerable parameters being config, version, win, db, pwd, and user. Additionally, the...
CVE-2020-23376: Cross-Site Request Forgery (CSRF)
NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parameter to launch a stored XSS attack...
Cross site scripting
A stored cross-site scripting XSS vulnerability in SourceCodester Budget Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php via vulnerable field 'Budget Title'...
CVE-2021-29388
A stored cross-site scripting XSS vulnerability in SourceCodester Budget Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php via vulnerable field 'Budget Title'...
PT-2021-18194
Name of the Vulnerable Software and Affected Versions: SourceCodester Budget Management System version 1.0 Description: A stored cross-site scripting issue allows users to inject and store arbitrary JavaScript code in index.php via the vulnerable field Budget Title. Recommendations: For...
CVE-2021-29388: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability in SourceCodester Budget Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php via vulnerable field 'Budget Title'...
CVE-2020-17563: Improper Limitation of a Pathname to a Restricted Directory
Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to " /index.php?s=/admin-tpl-del&id="...
CVE-2020-35313
A server-side request forgery SSRF vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin installer...
CVE-2020-35313: Server-Side Request Forgery (SSRF)
A server-side request forgery SSRF vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin installer...
CVE-2020-35314: Improper Neutralization of Special Elements used in an OS Command
A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to upload a custom plugin which can contain arbitrary code and obtain a webshell via the theme/plugin installer...
PT-2021-11750
Name of the Vulnerable Software and Affected Versions: WonderCMS version 3.1.3 Description: A remote code execution issue exists in the installUpdateThemePluginAction function in index.php, allowing remote attackers to upload a custom plugin containing arbitrary code and obtain a webshell via the...