CVE-2019-17611: Improper Neutralization of Input During Web Page Generation

HongCMS 3.0.0 has XSS via the install/index.php tableprefix parameter...

CVE-2019-17610: Improper Neutralization of Input During Web Page Generation

HongCMS 3.0.0 has XSS via the install/index.php dbpassword parameter...

CVE-2019-17607: Improper Neutralization of Input During Web Page Generation

HongCMS 3.0.0 has XSS via the install/index.php servername parameter...

CVE-2019-17609: Improper Neutralization of Input During Web Page Generation

HongCMS 3.0.0 has XSS via the install/index.php dbusername parameter...

PT-2019-15230

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue is related to a security problem where an attacker can inject malicious code. The estimated number of potentially affected devices is not provided. Technical details about exploitation include the...

CVE-2019-17608: Improper Neutralization of Input During Web Page Generation

HongCMS 3.0.0 has XSS via the install/index.php dbname parameter...

CVE-2019-17612

An issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the list method in the Common/Controller/BackendController.class.php file via the index.php?m=Admin&c=Ad&a=category sort parameter...

CVE-2019-17613

qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in...

CVE-2019-17613

qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in...

PT-2019-15232

Name of the Vulnerable Software and Affected Versions 74CMS version 5.2.8 Description An issue was discovered that allows SQL Injection, generated by the list method in the Common/Controller/BackendController.class.php file via the index.php?m=Admin&c=Ad&a=category API endpoint, specifically...

CVE-2019-17612: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in 74CMS v5.2.8. There is a SQL Injection generated by the list method in the Common/Controller/BackendController.class.php file via the index.php?m=Admin&c=Ad&a=category sort parameter...

CVE-2019-17613: Improper Control of Generation of Code

qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in...

PT-2019-15182

Name of the Vulnerable Software and Affected Versions Hotaru CMS version 1.7.2 Description A stored XSS issue was found in the admin index.php?page=settings SITE NAME field, allowing for potential exploitation. Recommendations For Hotaru CMS version 1.7.2, update to a newer version that contains ...

CVE-2010-5335: Improper Limitation of a Pathname to a Restricted Directory

IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver and the operating system. Input passed via a certain parameter script to basic/minimizer/index.php is not properly sanitised and can therefore be exploited t...

PT-2019-6603

Name of the Vulnerable Software and Affected Versions IceWarp Webclient versions prior to 10.2.1 Description The issue allows for directory traversal, potentially resulting in the loss of confidential data from IceWarp Mailserver and the operating system. Input passed via a certain parameter to t...

CVE-2015-9479

The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php...

CVE-2019-17431

An issue was discovered in fastadmin 1.0.0.20190705beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerability...

PT-2019-7438

Name of the Vulnerable Software and Affected Versions ACF-Frontend-Display plugin through 2015-07-03 for WordPress Description The issue allows for arbitrary file upload via an action=upload request to "js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php". Recommendations For versions of t...

PT-2019-15152

Name of the Vulnerable Software and Affected Versions fastadmin version 1.0.0.20190705 beta Description An issue was discovered in the software, specifically a CSRF vulnerability in the public/index.php/admin/auth/admin/add endpoint. Recommendations For fastadmin version 1.0.0.20190705 beta, as a...

CVE-2015-9479: Unrestricted Upload of File with Dangerous Type

The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php...