CVE-2018-18723: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in index.php/admin/area/editarea/id/110000 in YUNUCMS 1.1.5...

CVE-2018-18723

CVE-2018-18723 is an XSS vulnerability in YUNUCMS 1.1.5, located at index.php/admin/area/editarea/id/110000. The connected documents confirm the affected product/version and the specific vulnerable parameter/path, but do not provide details on the underlying root cause, exploit techniques, or ava...

CVE-2018-18723

An XSS issue was discovered in index.php/admin/area/editarea/id/110000 in YUNUCMS 1.1.5...

PT-2018-14601

Name of the Vulnerable Software and Affected Versions YUNUCMS version 1.1.5 Description A cross-site scripting XSS issue was found in the "index.php/admin/area/editarea/id/110000" endpoint. This issue allows for potential malicious script execution. Recommendations For YUNUCMS version 1.1.5, upda...

PT-2018-14598

Name of the Vulnerable Software and Affected Versions YUNUCMS version 1.1.5 Description A cross-site scripting XSS issue was found in the index.php/admin/system/basic endpoint of YUNUCMS. Recommendations For YUNUCMS version 1.1.5, update to a newer version that contains a fix for this issue...

PT-2018-14602

Name of the Vulnerable Software and Affected Versions YUNUCMS version 1.1.5 Description A cross-site scripting XSS issue was found in the "index.php/admin/category/editcategory?id=73" API endpoint. This issue affects the ability to securely manage categories. Recommendations For YUNUCMS version...

CVE-2018-18705

PhpTpoint Hospital Management System (PHP) contains multiple SQL injection vulnerabilities reachable via index.php (user parameter in LOGIN.php) and via rno parameters to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php. Exploitation could allow bypassing login to obtain database information or exe...

CVE-2018-18704

PhpTpoint Pharmacy Management System suffers from a SQL injection vulnerability in the index.php username parameter...

PT-2018-14583

Name of the Vulnerable Software and Affected Versions PhpTpoint hospital management system affected versions not specified Description The issue concerns SQL injection vulnerabilities. These vulnerabilities can be exploited via the user parameter in index.php associated with LOGIN.php, or the rno...

CVE-2018-18711: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=editinfo...

CVE-2018-18712: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's username via index.php?m=member&f=index&v=edit&uid=1...

CVE-2018-18704: Improper Neutralization of Special Elements used in an SQL Command

PhpTpoint Pharmacy Management System suffers from a SQL injection vulnerability in the index.php username parameter...

CVE-2018-18705: Improper Neutralization of Special Elements used in an SQL Command

PhpTpoint hospital management system suffers from multiple SQL injection vulnerabilities via the index.php user parameter associated with LOGIN.php, or the rno parameter to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php...

PT-2018-14589

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A CSRF issue allows changing the super administrator's password via the "index.php?m=core&f=panel&v=edit info" API endpoint. Recommendations For WUZHI CMS version 4.1.0, update to a newer version that contai...

PT-2018-14590

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A CSRF issue allows changing the super administrator's username via the "index.php?m=member&f=index&v=edit&uid=1" endpoint, specifically targeting the uid variable set to 1, which corresponds to the super...

PT-2018-14582

Name of the Vulnerable Software and Affected Versions PhpTpoint Pharmacy Management System affected versions not specified Description The issue is related to a SQL injection vulnerability. It affects the username parameter in the "index.php" endpoint. Recommendations At the moment, there is no...

CVE-2018-18694: Improper Neutralization of Input During Web Page Generation

admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases...

PT-2018-14575

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns stored XSS that can be triggered by remote authenticated administrators. This occurs when a file without an extension is uploaded, and in certain cases, this file is interpreted as...

CVE-2018-18622

CVE-2018-18622 affects Waimai Super Cms 20150505. The issue is a Cross-Site Scripting (XSS) vulnerability exploitable through the username parameter in index.php?m=public&a=doregister, as reported by multiple sources (Red Hat, CNVD, NVD). Root cause is unsanitized input that allows injection of s...

CVE-2018-18626: Undefined Security Weakness

An issue was discovered in PHPYun V4.6. There is a vulnerability that can delete any file or directory via the "admin/index.php?m=database&c=del" sql parameter because delaction in admin/model/database.class.php mishandles this parameter...