CVE-2018-17830

The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted only values are restricted. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=&args substring...

CVE-2018-17832

XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter...

CVE-2018-17832

WUZHICMS 2.0 is affected by a Cross-Site Scripting (XSS) vulnerability in index.php, exploitable via the v and f GET parameters. The issue is described as XSS in the WUZHICMS 2.0 web application, with PoC references showing injected content via index.php?v= and index.php?f=. No explicit root-caus...

CVE-2018-17852

A SQL injection was discovered in WUZHI CMS 4.1.0 in coreframe/app/coupon/admin/card.php via the groupname parameter to the /index.php?m=coupon&f=card&v=detaillisting URI...

CVE-2018-17831

In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rexlist class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rexlist were used...

CVE-2018-17830: Improper Neutralization of Input During Web Page Generation

The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted only values are restricted. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=&args substring...

CVE-2018-17832: Improper Neutralization of Input During Web Page Generation

XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter...

CVE-2018-17831: Improper Neutralization of Special Elements used in an SQL Command

In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rexlist class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rexlist were used...

PT-2018-14212

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 2.0 Description A security issue exists due to the presence of XSS in the software. The issue is related to the v or f parameter in the "index.php" endpoint. Recommendations For WUZHI CMS version 2.0, consider restricting...

PT-2018-14211

Name of the Vulnerable Software and Affected Versions REDAXO versions prior to 5.6.3 Description A critical SQL injection issue has been found in the rex list class due to the prepareQuery function in core/lib/list.php. This can be exploited via the "sort" parameter in the...

PT-2018-14210

Name of the Vulnerable Software and Affected Versions REDAXO version 5.6.2 Description The issue concerns the $args variable in the addons/mediapool/pages/index.php file, where names are not restricted, allowing an attacker to insert XSS payloads. This can be achieved via the...

PT-2018-14225

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A SQL injection issue was found in the coreframe/app/coupon/admin/card.php file, specifically via the groupname parameter to the "/index.php?m=coupon&f=card&v=detail listing" API endpoint. Recommendations Fo...

WUZHICMS 2.0 - Cross-Site Scripting

Title: WUZHICMS 2.0 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Date: 2018-10-01 Vendor: http://www.wuzhicms.com Software: WUZHICMS 2.0 CVE: CVE-2018-17832 Technical Details & Description: A Cross Site Scripting vulnerability has been discovered in the WUZHICMS 2.0 web-application. The...

Joomla! Component Music Collection 3.0.3 - SQL Injection

Exploit Title: Joomla! Component Music Collection 3.0.3 - SQL Injection Dork: N/A Date: 2018-09-24 Vendor Homepage: http://joomlathat.com/ Software Link: https://extensions.joomla.org/extensions/extension/multimedia/multimedia-players/music-collection/ Version: 3.0.3 Category: Webapps Tested on:...

CVE-2018-17361

Multiple XSS vulnerabilities in WeaselCMS v0.3.6 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php because $SERVER'PHPSELF' is mishandled...

CVE-2018-17361

Multiple XSS vulnerabilities in WeaselCMS v0.3.6 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php because $SERVER'PHPSELF' is mishandled...

CVE-2018-17361

Multiple XSS vulnerabilities in WeaselCMS v0.3.6 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php because $SERVER'PHPSELF' is mishandled...

CVE-2018-17361

CVE-2018-17361 affects WeaselCMS v0.3.6 (PHP). Multiple XSS vulnerabilities allow remote attackers to inject arbitrary web script or HTML via PATH_INFO to index.php; root cause is mishandling of $_SERVER['PHP_SELF']. Public exploit details are not provided in the connected documents; no remediati...

CVE-2018-17361: Improper Neutralization of Input During Web Page Generation

Multiple XSS vulnerabilities in WeaselCMS v0.3.6 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to index.php because $SERVER'PHPSELF' is mishandled...

PT-2018-13992

Name of the Vulnerable Software and Affected Versions WeaselCMS version 0.3.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO to index.php because $ SERVER'PHP SELF' is mishandled. This can be exploited by sending a malicious request to the...