13520 matches found
PT-2018-13851
Name of the Vulnerable Software and Affected Versions UCMS version 1.4.6 Description The issue is related to SQL injection that occurs during the installation process. Specifically, the mysql dbname parameter in the install/index.php endpoint is vulnerable. Recommendations For version 1.4.6, avoi...
CVE-2018-17024
admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an addpage action...
CVE-2018-17024
admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an addpage action...
CVE-2018-17025
CVE-2018-17025 affects Monstra CMS 3.0.4. The issue is an XSS in admin/index.php via the page_meta_title parameter in an edit_page action for pages with no special role. Documented impact is XSS; no exploitation details are provided in the sources. CVSS scores listed: CVSS v2 base 4.3 (Medium) an...
CVE-2018-17025
admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage action for a page with no special role...
PT-2018-13846
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns an XSS exploit via the page meta title parameter in the admin/index.php file when performing an edit page action for a page without a special role. Recommendations For Monstra CMS versio...
CVE-2018-17025: Improper Neutralization of Input During Web Page Generation
admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage action for a page with no special role...
PT-2018-13845
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns an XSS exploit via the page meta title parameter in the add page action. This is related to the admin/index.php file in Monstra CMS. Recommendations For Monstra CMS version 3.0.4, avoid...
PT-2018-13847
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns an XSS vulnerability. It can be exploited via the page meta title parameter in an "edit page&name=error404" action on the "admin/index.php" page. Recommendations For Monstra CMS version...
CVE-2018-17026: Improper Neutralization of Input During Web Page Generation
admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage&name=error404 action, a different vulnerability than CVE-2018-10121...
CVE-2018-17024: Improper Neutralization of Input During Web Page Generation
admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an addpage action...
CVE-2018-16728
feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new...
CVE-2018-16728
feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new...
CVE-2018-16728: Improper Neutralization of Input During Web Page Generation
feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new...
PT-2018-13705
Name of the Vulnerable Software and Affected Versions feindura version 2.0.7 Description The issue allows for XSS via the tags field of a new page created at "index.php?category=0&page=new". Recommendations For feindura version 2.0.7, consider restricting access to the tags field in the new page...
mrklingo.freeshell.org XSS vulnerability
Open Bug Bounty ID: OBB-675088 Description| Value ---|--- Affected Website:| mrklingo.freeshell.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Arbitrary file deletion
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete...
CVE-2018-16774
HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete...
CVE-2018-16773
EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field...
CVE-2018-16608: Authorization Bypass Through User-Controlled Key
In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the administrator via an admin/index.php?id=users&action=edit&userid=1, Insecure Direct Object Reference IDOR...