13520 matches found
CVE-2018-18296: Improper Neutralization of Input During Web Page Generation
MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action...
PT-2018-14401
Name of the Vulnerable Software and Affected Versions DESHANG DSCMS version 1.1 Description The issue is related to a CSRF problem. It affects the "public/index.php/admin/admin/add.html" URI. Recommendations For DESHANG DSCMS version 1.1, consider implementing proper CSRF protection mechanisms to...
PT-2018-14396
Name of the Vulnerable Software and Affected Versions MetInfo version 6.1.2 Description The issue allows for XSS via the /admin/index.php endpoint with the bigclass parameter in an n=column&a=doadd action. This affects the bigclass parameter, which is used in the specified action. Recommendations...
CVE-2018-18324: Improper Neutralization of Input During Web Page Generation
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fmcurrentdir parameter, or the admin/index.php module, servicestart, servicefullstatus, servicerestart, servicestop, or file within the fileeditor parameter...
CVE-2018-18322: Improper Neutralization of Special Elements used in an OS Command
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php servicestart, servicerestart, servicefullstatus, or servicestop parameter...
CVE-2018-18290: Improper Neutralization of Input During Web Page Generation
An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml&name=homecontent allows XSS via the HTML Source Editor. NOTE: the vendor disputes this because the form requires administrator privileges, and entering JavaScript is supported functionality...
CVE-2018-18257: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in BageCMS 3.1.3. An attacker can delete any files and folders on the web server via an index.php?r=admini/template/batch&command=deleteFile&fileName= or index.php?r=admini/template/batch&command=deleteFolder&folderName=../ directory traversal URI...
CVE-2018-18258: Improper Control of Generation of Code
An issue was discovered in BageCMS 3.1.3. The attacker can execute arbitrary PHP code on the web server and can read any file on the web server via an index.php?r=admini/template/updateTpl&filename= URI...
PT-2018-14383
Name of the Vulnerable Software and Affected Versions BageCMS version 3.1.3 Description An issue was discovered that allows an attacker to delete any files and folders on the web server via a directory traversal attack using specific URI requests, such as...
PT-2018-14384
Name of the Vulnerable Software and Affected Versions BageCMS version 3.1.3 Description An issue allows an attacker to execute arbitrary PHP code on the web server and read any file via an index.php?r=admini/template/updateTpl&filename= URI. Recommendations For BageCMS version 3.1.3, as a tempora...
CVE-2018-18209
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenttype parameter...
CVE-2018-18210
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenturl parameter...
PT-2018-14369
Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A security issue exists due to the presence of XSS in the attachment type parameter of the "admin/index.php/setting/site?tab=site attachment" endpoint. Recommendations For DiliCMS version 2.4.0, avoid using th...
PT-2018-14371
Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A security issue exists due to the presence of XSS in the attachment url parameter of the "admin/index.php/setting/site?tab=site attachment" endpoint. Recommendations For DiliCMS version 2.4.0, avoid using the...
CVE-2018-18210: Improper Neutralization of Input During Web Page Generation
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenturl parameter...
CVE-2018-18209: Improper Neutralization of Input During Web Page Generation
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenttype parameter...
CVE-2018-18198
The $openerinputfield variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=XSS request...
CVE-2018-18198
The $openerinputfield variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=XSS request...
CVE-2018-18198
The CVE-2018-18198 issue affects REDAXO 5.6.3 via addons/mediapool/pages/index.php where the $opener_input_field is not properly filtered and is echoed to the page. This allows an attacker to inject XSS payloads through a request such as index.php?page=mediapool/media&opener_input_field=[XSS]. Re...
