13511 matches found
CVE-2019-9915
GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...
PT-2019-19933
Name of the Vulnerable Software and Affected Versions GetSimpleCMS version 3.3.13 Description The issue is related to an Open Redirect via the redirect parameter in the admin/index.php endpoint. Recommendations For GetSimpleCMS version 3.3.13, consider restricting access to the admin/index.php...
CVE-2019-9915: URL Redirection to Untrusted Site
GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...
PT-2019-9631
Name of the Vulnerable Software and Affected Versions Attendance Monitoring System version 1.0 Description The issue concerns a SQL Injection flaw. It affects the id parameter in several API endpoints: "student/index.php?view=view", "event/index.php?view=view", and "user/index.php?view=view"...
CVE-2018-18798: Improper Neutralization of Special Elements used in an SQL Command
Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.php?view=view, and user/index.php?view=view...
CVE-2018-18845: Improper Neutralization of Input During Web Page Generation
internal/advancedcommentsystem/index.php and internal/advancedcommentsystem/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACSpath. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTM...
CVE-2019-7223: Improper Neutralization of Input During Web Page Generation
InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoicepassword parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/ URI. NOTE: this is different from CVE-2018-12255...
PT-2019-18473
Name of the Vulnerable Software and Affected Versions InvoicePlane version 1.5 Description The issue is related to stored XSS via the invoice password parameter, also known as the "PDF password" field, in the "Create Invoice" option. The XSS payload is rendered at an "index.php/invoices/view/" UR...
CVE-2019-9769
PilusCart 1.4.1 is vulnerable to index.php?module=users&action=newUser CSRF, leading to the addition of a new user as administrator...
PT-2019-19877
Name of the Vulnerable Software and Affected Versions FeiFeiCMS version 4.1.190209 Description The issue allows remote attackers to upload and execute arbitrary PHP code. This can be achieved by modifying the set of allowable file extensions through the "Admin-Index" page at the...
CVE-2019-9825: Unrestricted Upload of File with Dangerous Type
FeiFeiCMS 4.1.190209 allows remote attackers to upload and execute arbitrary PHP code by visiting index.php?s=Admin-Index to modify the set of allowable file extensions, as demonstrated by adding php to the default jpg,gif,png,jpeg setting, and then using the "add article" feature...
PT-2019-19860
Name of the Vulnerable Software and Affected Versions PilusCart version 1.4.1 Description The issue allows for a CSRF attack via the "index.php?module=users&action=newUser" endpoint, potentially leading to the addition of a new user with administrator privileges. Recommendations For PilusCart...
CVE-2019-9688
sftnow through 2018-12-29 allows index.php?g=Admin&m=User&a=addpost CSRF to add an admin account...
PT-2019-19798
Name of the Vulnerable Software and Affected Versions sftnow versions prior to 2018-12-29 Description The issue allows for a CSRF attack via the "index.php?g=Admin&m=User&a=add post" endpoint to add an admin account. Recommendations For versions prior to 2018-12-29, update to a version released...
CVE-2019-9688: Cross-Site Request Forgery (CSRF)
sftnow through 2018-12-29 allows index.php?g=Admin&m=User&a=addpost CSRF to add an admin account...
CVE-2018-17426
WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI...
CVE-2018-17425
WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI...
CVE-2013-7468
Simple Machines Forum SMF 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter...
CVE-2019-8438
CVE-2019-8438 affects DiliCMS 2.4.0. A Stored XSS vulnerability exists in the first textbox of System setting -> site setting (admin/index.php), specifically the site_name field. The issue is described without exploit details in the provided sources; CVSS scores from NVD indicate a Low to Medi...