13521 matches found
CVE-2018-15893
CVE-2018-15893: A SQL injection vulnerability exists in WUZHI CMS 4.1.0 in /coreframe/app/admin/copyfrom.php, exploitable via index.php?m=core&f=copyfrom&v=listing keywords parameter. NVD/OSV entries show CVSS v3.0 base score 9.8 (CRITICAL) and CVSS v2.0 base 7.5 with NETWORK attack vector and no...
CVE-2018-15894: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection was discovered in /coreframe/app/admin/pay/admin/index.php in WUZHI CMS 4.1.0 via the index.php?m=pay&f=index&v=listing keyValue parameter...
PT-2018-13274
Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A SQL injection issue was found in the /coreframe/app/admin/pay/admin/index.php file of WUZHI CMS. The issue is related to the keyValue parameter in the "index.php?m=pay&f=index&v=listing" API endpoint...
CVE-2017-18345
The Joomanager component through 2.0.0 for Joomla! has an arbitrary file download issue, resulting in exposing the credentials of the database via an index.php?option=comjoomanager&controller=details&task=download&path=configuration.php request...
PT-2018-6842
Name of the Vulnerable Software and Affected Versions: Joomanager component for Joomla! versions through 2.0.0 Description: The issue allows for arbitrary file download, which can expose database credentials. This can be achieved through a request to "index.php?option=com...
Cross site request forgery (csrf)
An issue was discovered in fledrCMS through 2014-02-03. There is a CSRF vulnerability that can change the administrator's password via index.php?p=done&savedata=1...
CVE-2018-15846: Cross-Site Request Forgery (CSRF)
An issue was discovered in fledrCMS through 2014-02-03. There is a CSRF vulnerability that can change the administrator's password via index.php?p=done&savedata=1...
CVE-2018-15850: Cross-Site Request Forgery (CSRF)
An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an administrator account via index.php?page=user...
PT-2018-13235
Name of the Vulnerable Software and Affected Versions fledrCMS versions prior to 2014-02-03 Description An issue was discovered that allows a CSRF vulnerability to change the administrator's password. This can be done via the "index.php?p=done&savedata=1" endpoint. Recommendations For versions...
PT-2018-13240
Name of the Vulnerable Software and Affected Versions REDAXO CMS version 4.7.2 Description An issue was discovered that allows for a CSRF vulnerability, enabling the addition of an administrator account via the "index.php?page=user" endpoint. The page and user parameters are involved in this issu...
Twitter-Clone 1 - userid SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Twitter-Clone 1 - 'userid' SQL Injection Exploit Author: L0RD Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/ Version: 1 CVE: N/A Tested on: Win 10 POC : SQLi vulnerable files : follow.php , index.php vulnerable...
Twitter-Clone 1 - userid SQL Injection
Twitter-Clone 1 - userid SQL Injection Exploit Title: Twitter-Clone 1 - 'userid' SQL Injection Date: 2018-08-21 Exploit Author: L0RD Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/ Version: 1 CVE: N/A Tested on: Win 10 POC : SQLi vulnerable files : follow.php , index.php vulnerable...
CVE-2018-15203
An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/addpage allows a CSRF attack to add pages...
CVE-2018-15177: Cross-Site Request Forgery (CSRF)
In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account...
CVE-2018-15203: Cross-Site Request Forgery (CSRF)
An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/addpage allows a CSRF attack to add pages...
PT-2018-12925
Name of the Vulnerable Software and Affected Versions Gxlcms version 2.0 Description The issue allows for a CSRF attack, which can be used to add an administrator account through the news/index.php?s=Admin-Admin-Insert endpoint. Recommendations For Gxlcms version 2.0, consider implementing CSRF...
CVE-2018-15130
ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter...
CVE-2018-15130
ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter...
CVE-2018-15130
CVE-2018-15130 affects ThinkSAAS up to 2018-07-25. The vulnerability is a Cross-Site Scripting (XSS) flaw exploitable via the parameter groupdesc in the URL path index.php?app=group&ac=create&ts=do, allowing injection of arbitrary web script/HTML into the page. Root cause details beyond XSS are n...