PT-2018-13135

Name of the Vulnerable Software and Affected Versions BTITeam XBTIT version 2.5.4 Description The issue concerns a stored XSS exploit via the title of a news item in the newsfeed, accessible through the API endpoint "/index.php?page=viewnews". This exploit is also possible through CSRF...

PT-2018-13136

Name of the Vulnerable Software and Affected Versions BTITeam XBTIT version 2.5.4 Description An issue was discovered in the sign-up page available at /index.php?page=signup, where the act parameter is vulnerable to reflected cross-site scripting. Recommendations For version 2.5.4, consider...

CVE-2018-15679: Improper Neutralization of Input During Web Page Generation

An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php?page=forums&action=search is vulnerable to reflected cross-site scripting...

CVE-2018-16549: Improper Limitation of a Pathname to a Restricted Directory

HScripts PHP File Browser Script v1.0 allows Directory Traversal via the index.php path parameter...

CVE-2018-16458: Cross-Site Request Forgery (CSRF)

An issue was discovered in baigo CMS v2.1.1. There is an index.php?m=article&c=request CSRF that can cause publication of any article...

PT-2018-13583

Name of the Vulnerable Software and Affected Versions baigo CMS version 2.1.1 Description An issue in baigo CMS allows a CSRF attack via the index.php?m=article&c=request endpoint, potentially causing the publication of any article. Recommendations For baigo CMS version 2.1.1, consider disabling...

PT-2018-13526

Name of the Vulnerable Software and Affected Versions IdeaCMS versions through 2016-04-30 Description The issue is related to a reflected XSS that can be exploited via the kw parameter in the "index.php?c=content&a=search" endpoint. The product is discontinued. Recommendations For IdeaCMS version...

CVE-2018-16372: Improper Neutralization of Input During Web Page Generation

The issue was discovered in IdeaCMS through 2016-04-30. There is reflected XSS via the index.php?c=content&a=search kw parameter. NOTE: this product is discontinued...

Sql injection

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter...

CVE-2018-16352

There is a PHP code upload vulnerability in WeaselCMS 0.3.6 via index.php because code can be embedded at the end of a .png file when the image/png content type is used...

CVE-2018-16353

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the /index.php/Customer/read limit parameter...

CVE-2018-16352

There is a PHP code upload vulnerability in WeaselCMS 0.3.6 via index.php because code can be embedded at the end of a .png file when the image/png content type is used...

CVE-2018-16354

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter...

CVE-2018-16354

CVE-2018-16354 affects FHCRM (free/open source product management system). The connected CNVD/CVE records describe a SQL injection vulnerability exposed by the index.php/User/read limit parameter, with attackers potentially executing arbitrary SQL commands. FHCRM versions up to 2018-02-11 are imp...

Design/Logic Flaw

WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic formstatcode parameter...

CVE-2018-16349: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 has XSS via the index.php?m=link&f=index&v=add formremark parameter...

CVE-2018-16350: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic formstatcode parameter...

CVE-2018-16345: Cross-Site Request Forgery (CSRF)

An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...

CVE-2018-16353: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the /index.php/Customer/read limit parameter...

CVE-2018-16352: Unrestricted Upload of File with Dangerous Type

There is a PHP code upload vulnerability in WeaselCMS 0.3.6 via index.php because code can be embedded at the end of a .png file when the image/png content type is used...