Design/Logic Flaw

rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true...

PT-2020-17322

Name of the Vulnerable Software and Affected Versions rainrocka xinhu version 2.1.9 Description The issue allows remote attackers to obtain sensitive information via an "index.php?a=gettotal" request in which the ajaxbool value is manipulated to be true. This can lead to unauthorized access to...

CVE-2020-35388: Undefined Security Weakness

rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true...

CVE-2020-35709

bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...

CVE-2020-35709: Improper Limitation of a Pathname to a Restricted Directory

bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...

PT-2020-17398

Name of the Vulnerable Software and Affected Versions bloofoxCMS version 0.5.2.1 Description The issue allows admins to upload arbitrary .php files to ../media/images/ via the "admin/index.php?mode=tools&page=upload" URI, which is a directory traversal issue. This is achieved by using a...

CVE-2020-28184

Cross-site scripting XSS vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php...

PT-2020-16939

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions 4.2.06 and earlier Description The issue allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to "/module/index.php" API endpoint. This enables attackers to execute malicious...

CVE-2020-28184: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php...

PT-2020-16942

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions 4.2.06 and earlier Description The issue allows remote authenticated attackers to read, edit, or delete any file within the filesystem. This can be achieved via the filename parameter to "/tos/index.php?editor/fileGet"...

CVE-2020-35598: Improper Limitation of a Pathname to a Restricted Directory

ACS Advanced Comment System 1.0 is affected by Directory Traversal via an advancedcomponentsystem/index.php?ACSpath=..%2f URI. NOTE: this might be the same as CVE-2009-4623...

PT-2020-17357

Name of the Vulnerable Software and Affected Versions ACS Advanced Comment System version 1.0 Description The issue allows Directory Traversal via the advanced component system/index.php API endpoint, specifically through the ACS path variable. This can be exploited by manipulating the ACS path...

EGavilan Barcodes generator cross-site scripting vulnerability

Egavilan Media Barcodes generator is a Php-based barcode generator for product names from Egavilan Media. EGavilan Barcodes generator 1.0 suffers from a cross-site scripting vulnerability that originates from cross-site scripting XSS via index.php. An attacker can exploit this vulnerability to...

ListingPro < 2.6.1 - Unauthenticated Sensitive Data Disclosure (Usernames, Emails etc)

Unauthenticated users could gain access to sensitive data, such as usernames, full names, email addresses and in some case phone numbers by sending a request to /wp-admin/index.php?download-lp-users=yes which is registered to the init hook...

Phpjabbers Appointment Scheduler Cross-Site Scripting Vulnerability

Phpjabbers Appointment Scheduler is a Php-based appointment scheduler plugin for planning time and scheduling meetings from Phpjabbers Serbia. PHPJabbers Appointment Scheduler 2.3 is vulnerable to a cross-site scripting vulnerability that originates in the index.php administrative login page with...

CVE-2020-35396

EGavilan Barcodes generator 1.0 is affected by: Cross Site Scripting XSS via the index.php. An Attacker is able to inject the XSS payload in the web application each time a user visits the website...

Cross site scripting

EGavilan Barcodes generator 1.0 is affected by: Cross Site Scripting XSS via the index.php. An Attacker is able to inject the XSS payload in the web application each time a user visits the website...

CVE-2020-35396

EGavilan Barcodes generator 1.0 is affected by: Cross Site Scripting XSS via the index.php. An Attacker is able to inject the XSS payload in the web application each time a user visits the website...

CVE-2020-35396

EGavilan Barcodes generator 1.0 is affected by: Cross Site Scripting XSS via the index.php. An Attacker is able to inject the XSS payload in the web application each time a user visits the website...

SourceCodester Online Examination System Cross-Site Scripting Vulnerability (CNVD-2020-74075)

SourceCodester Online Examination System is an online examination system from SourceCodester, Inc. in the United States. SourceCodester Online Examination System 1.0 suffers from a cross-site scripting vulnerability that originates in the w parameter of index.php, which can be exploited by an...