CVE-2019-11450: Improper Neutralization of Special Elements used in an SQL Command

whatsns 4.0 allows index.php?question/ajaxadd.html title SQL injection...

CVE-2019-11447: Unrestricted Upload of File with Dangerous Type

An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatarfile field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content ...

PT-2019-12315

Name of the Vulnerable Software and Affected Versions whatsns version 4.0 Description The issue allows for SQL injection through the title parameter in the index.php?question/ajaxadd.html endpoint. Recommendations For version 4.0, avoid using the title parameter in the...

Cross site request forgery (csrf)

74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI...

CVE-2019-11374

74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI...

CVE-2019-11374: Cross-Site Request Forgery (CSRF)

74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI...

PT-2019-12265

Name of the Vulnerable Software and Affected Versions 74CMS version 5.0.1 Description The issue allows an attacker to add a new admin user via the "index.php?m=Admin&c=admin&a=add" API endpoint. This is due to a CSRF vulnerability. Recommendations For version 5.0.1, update to a newer version that...

PT-2019-9758

Name of the Vulnerable Software and Affected Versions MyBB versions 1.8.x through 1.8.19 Description A reflected XSS issue allows remote attackers to inject JavaScript via the upsettingbburl parameter in the index.php file. Recommendations For MyBB versions 1.8.x through 1.8.19, update to a versi...

CVE-2018-19202: Improper Neutralization of Input During Web Page Generation

A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsettingbburl' parameter...

PT-2019-11990

Name of the Vulnerable Software and Affected Versions 74cms version 5.0.1 Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the site domain parameter in the /index.php?m=Admin&c=config&a=edit API endpoint. Recommendations For version 5.0.1, as a...

Rukovoditel ERP & CRM 2.4.1 - path Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Rukovoditel ERP & CRM 2.4.1 - 'path' Cross-Site Scripting Exploit Author: Javier Olmedo Website: https://hackpuntes.com Vendor: Rukovoditel Software Link: https://sourceforge.net/projects/rukovoditel/ Affected Version: 2.4.1 and...

Nextcloud: [Reflected XSS] In Request URL

In index.php file on 1765 we can see XSS: " Because NextCloud allow links like: '/index.php/ANYCONTENT' If we will do request like: POST /updater/index.php/h"alert1; HTTP/1.1 Host: vulns.local Content-Type: application/x-www-form-urlencoded Content-Length: 33 updater-secret-input=OURSECRET We wil...

Rukovoditel ERP & CRM 2.4.1 - 'path' Cross-Site Scripting

Exploit Title: Rukovoditel ERP & CRM 2.4.1 - 'path' Cross-Site Scripting Exploit Author: Javier Olmedo Website: https://hackpuntes.com Date: 2019-03-24 Google Dork: N/A Vendor: Rukovoditel Software Link: https://sourceforge.net/projects/rukovoditel/ Affected Version: 2.4.1 and possibly before...

CVE-2019-9915

GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...

Open redirect

GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...

CVE-2019-9915

GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...

CVE-2019-9915

GetSimple CMS 3.3.13 contains an Open Redirect vulnerability exposed via the admin/index.php redirect parameter. An attacker can cause victims to be redirected to a malicious site, with potential for phishing or unauthorized operations depending on the redirected context. The issue is documented ...

CVE-2019-9915

GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...

CVE-2019-9915

GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...

PT-2019-19933

Name of the Vulnerable Software and Affected Versions GetSimpleCMS version 3.3.13 Description The issue is related to an Open Redirect via the redirect parameter in the admin/index.php endpoint. Recommendations For GetSimpleCMS version 3.3.13, consider restricting access to the admin/index.php...