13509 matches found
CVE-2019-12962: Improper Neutralization of Input During Web Page Generation
LiveZilla Server before 8.0.1.1 is vulnerable to XSS in mobile/index.php via the Accept-Language HTTP header...
FreePBX Backup Module Command Injection Vulnerability
FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX project for configuring Asterisk IP telephony system through a GUI web-based graphical interface. A command injection vulnerability exists in the app/backup/index.php file of the Backup module in FreePBX versi...
CVE-2019-11410: Improper Neutralization of Special Elements used in an OS Command
app/backup/index.php in the Backup Module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administrative attackers to execute commands on the host...
CVE-2018-19465
Maccms through 8.0 allows XSS via the sitekeywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/systemconfig.html, related to template/paody/html/vodindex.html...
CVE-2018-19465
CVE-2018-19465 affects Maccms up to version 8.0, allowing Cross-Site Scripting (XSS) via the site_keywords field used in index.php?m=system-config. The root cause is tied to template files: tpl/module/system.php and tpl/html/system_config.html, with related references to template/paody/html/vod_i...
CVE-2018-19465
Maccms through 8.0 allows XSS via the sitekeywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/systemconfig.html, related to template/paody/html/vodindex.html...
PT-2019-9825
Name of the Vulnerable Software and Affected Versions Maccms versions through 8.0 Description The issue allows for XSS via the site keywords field to "index.php?m=system-config" because of vulnerabilities in tpl/module/system.php and tpl/html/system config.html, related to template/paody/html/vod...
CVE-2018-19465: Improper Neutralization of Input During Web Page Generation
Maccms through 8.0 allows XSS via the sitekeywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/systemconfig.html, related to template/paody/html/vodindex.html...
PT-2019-11144
Name of the Vulnerable Software and Affected Versions: vtiger CRM versions prior to 7.0.1 Description: The issue is a reflected Cross-Site Scripting XSS vulnerability that could allow remote unauthenticated attackers to inject arbitrary web script or HTML via the...
CVE-2018-8047: Improper Neutralization of Input During Web Page Generation
vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting XSS vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List app parameter...
CVE-2019-12593: Improper Limitation of a Pathname to a Restricted Directory
IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal...
PT-2019-12881
Name of the Vulnerable Software and Affected Versions IceWarp Mail Server versions prior to 10.4.5 Description The issue is related to a local file inclusion vulnerability. This can be exploited via the /webmail/calendar/minimizer/index.php API endpoint, specifically by manipulating the style...
CVE-2019-9106
The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to execute or include local .php files, as demonstrated by menu=php://filter/convert.base64-encode/resource=index.php to read index.php...
Joomla and WordPress Found Harboring Malicious Redirect Code
Security researchers are warning owners of Joomla and WordPress websites of a malicious redirect script that is pushing visitors to malicious websites. On Thursday, Eugene Wozniak, a security researcher with Sucuri, published a report outlining a rogue hypertext access .htaccess injector found on...
CVE-2019-11876
In PrestaShop 1.7.5.2, the shopcountry parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup accepting terms and conditions before executing the malicious link...
PT-2019-12536
Name of the Vulnerable Software and Affected Versions PrestaShop version 1.7.5.2 Description The issue concerns a Reflected XSS affecting the shop country parameter in the install/index.php installation script/component. Exploitation requires a user to follow the initial setup stages, including...
PT-2019-7547
Name of the Vulnerable Software and Affected Versions osClass version 3.6.1 Description The issue allows for directory traversal via the plugin parameter, which can be exploited for remote PHP code execution. An administrator can upload an image containing PHP code in the EXIF data through the...
CVE-2019-11876: Improper Neutralization of Input During Web Page Generation
In PrestaShop 1.7.5.2, the shopcountry parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup accepting terms and conditions before executing the malicious link...
