13523 matches found
CVE-2018-16353: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the /index.php/Customer/read limit parameter...
CVE-2018-16352: Unrestricted Upload of File with Dangerous Type
There is a PHP code upload vulnerability in WeaselCMS 0.3.6 via index.php because code can be embedded at the end of a .png file when the image/png content type is used...
CVE-2018-16354: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter...
PT-2018-13513
Name of the Vulnerable Software and Affected Versions FHCRM versions prior to 2018-02-11 Description An issue was discovered that allows SQL injection via the limit parameter in the "index.php/User/read" endpoint. Recommendations For versions prior to 2018-02-11, consider restricting access to th...
PT-2018-13512
Name of the Vulnerable Software and Affected Versions FHCRM versions prior to 2018-02-11 Description An issue was discovered that allows SQL injection via the "/index.php/Customer/read" API endpoint, specifically through the limit parameter. Recommendations For versions prior to 2018-02-11,...
PT-2018-13505
Name of the Vulnerable Software and Affected Versions EasyCMS version 1.5 Description An issue was discovered that allows for a CSRF vulnerability, enabling the update of the admin password. This is achieved via the index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...
PT-2018-13509
Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue is related to a form parameter in a specific page. The remark parameter in the form on the page index.php?m=link&f=index&v=add is vulnerable to XSS attacks. Recommendations For WUZHI CMS version...
PT-2018-13510
Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue is related to a form parameter in a specific PHP file, allowing for XSS attacks. The vulnerable parameter is statcode in the form on the page index.php?m=core&f=set&v=basic. Recommendations For WUZ...
PT-2018-13511
Name of the Vulnerable Software and Affected Versions WeaselCMS version 0.3.6 Description The issue concerns a PHP code upload vulnerability. It can be exploited by embedding code at the end of a .png file when the image/png content type is used, specifically affecting the index.php file...
PT-2018-13430
Name of the Vulnerable Software and Affected Versions waimai Super Cms version 20150505 Description The issue allows attackers to modify the price of items in a cart by exploiting a logic flaw. This can be done by observing data in a packet capture and setting the item totals parameter to zero in...
Code injection
CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php...
CVE-2018-15562
CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php...
CVE-2018-15562
CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php...
CVE-2018-15562
CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php...
CVE-2018-15562
CMS ISWEB 3.5.3 is affected by a Cross-Site Scripting (XSS) vulnerability in index.php, exploitable via the parameters ordineRis, sezioneRicerca, or oggettiRicerca. The issue allows injection of arbitrary scripts/HTML, enabling remote attackers to run client-side code. Documented exploitation was...
PT-2018-13087
Name of the Vulnerable Software and Affected Versions CMS ISWEB version 3.5.3 Description The issue allows for XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to the "index.php" endpoint. Recommendations For CMS ISWEB version 3.5.3, consider restricting the use of the ordineRis...
CVE-2018-15562: Improper Neutralization of Input During Web Page Generation
CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php...
CVE-2018-6643: Improper Neutralization of Input During Web Page Generation
Infoblox NetMRI 7.1.1 has Reflected Cross-Site Scripting via the /api/docs/index.php query parameter...
PT-2018-17692
Name of the Vulnerable Software and Affected Versions Infoblox NetMRI version 7.1.1 Description The issue is related to Reflected Cross-Site Scripting. It can be exploited via the "/api/docs/index.php" API endpoint, specifically through a query parameter. Recommendations For Infoblox NetMRI versi...