CVE-2019-13396: Improper Limitation of a Pathname to a Restricted Directory

FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the forminclude parameter in an index.php?q=system-handle-form-submit POST request because of an includeonce in systemhandleformsubmit in modules/system/system.module...

CVE-2019-13472

PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file...

Cross site scripting

PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file...

CVE-2019-13472

PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file...

CVE-2019-13472

CVE-2019-13472 affects PHPWind 9.1.0. The vulnerability is an XSS issue in the index.php file, specifically in the c and m parameters. The connected documents confirm these are cross-site scripting vulnerabilities but do not provide exploitation details, affected versions beyond 9.1.0, or remedia...

PT-2019-13354

Name of the Vulnerable Software and Affected Versions PHPWind version 9.1.0 Description The issue concerns a security problem where an attacker can inject malicious scripts into the c and m parameters of the index.php file, potentially leading to unauthorized actions on the affected system...

CVE-2019-13472: Improper Neutralization of Input During Web Page Generation

PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file...

CVE-2019-13370

index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator...

PT-2019-5804

Name of the Vulnerable Software and Affected Versions D-Link Central WiFi Manager CWM100 versions prior to v1.03R0100 BETA6 Description A cross-site scripting XSS issue in the PayAction.class.php resource view allows remote attackers to inject arbitrary web script or HTML via the passcode paramet...

CVE-2019-13374: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6 allows remote attackers to inject arbitrary web script or HTML via the index.php/Pay/passcodeAuth passcode parameter...

CVE-2019-13370: Cross-Site Request Forgery (CSRF)

index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator...

CVE-2018-11227

Monstra CMS 3.0.4 and earlier has XSS via index.php...

CVE-2018-11227

Monstra CMS 3.0.4 and earlier has XSS via index.php...

CVE-2018-11227

Summary (CVE-2018-11227) : Monstra CMS ≤3.0.4 is affected by a Cross‑Site Scripting (XSS) vulnerability via index.php. An attacker can inject arbitrary script in the browser of users visiting the affected site, potentially stealing cookie‑based authentication credentials and enabling further brow...

PT-2019-8780

Name of the Vulnerable Software and Affected Versions Monstra CMS versions 3.0.4 and earlier Description The issue is related to a security problem where an attacker can execute malicious scripts. This is achieved through the index.php file, allowing for potential data theft or unauthorized...

CVE-2018-11227: Improper Neutralization of Input During Web Page Generation

Monstra CMS 3.0.4 and earlier has XSS via index.php...

PT-2019-13055

Name of the Vulnerable Software and Affected Versions LiveZilla Server versions prior to 8.0.1.1 Description The issue concerns a problem where an attacker can execute malicious scripts in the context of another user, potentially leading to unauthorized actions. This is achieved through the...

CVE-2019-12962: Improper Neutralization of Input During Web Page Generation

LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header...

FreePBX Backup Module Command Injection Vulnerability

FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX project for configuring Asterisk IP telephony system through a GUI web-based graphical interface. A command injection vulnerability exists in the app/backup/index.php file of the Backup module in FreePBX versi...

CVE-2019-11410: Improper Neutralization of Special Elements used in an OS Command

app/backup/index.php in the Backup Module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administrative attackers to execute commands on the host...