CVE-2018-15177: Cross-Site Request Forgery (CSRF)

In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account...

CVE-2018-15130

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter...

CVE-2018-15130

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter...

CVE-2018-15130

CVE-2018-15130 affects ThinkSAAS up to 2018-07-25. The vulnerability is a Cross-Site Scripting (XSS) flaw exploitable via the parameter groupdesc in the URL path index.php?app=group&ac=create&ts=do, allowing injection of arbitrary web script/HTML into the page. Root cause details beyond XSS are n...

CVE-2018-15129

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter...

CVE-2018-15129

ThinkSAAS up to 2018-07-25 is affected by a cross-site scripting (XSS) flaw in the content parameter for the article comment endpoint (index.php?app=article&ac=comment&ts=do content). The issue arises from user-supplied content being reflected without proper sanitization, enabling XSS. Connected ...

PT-2018-12888

Name of the Vulnerable Software and Affected Versions ThinkSAAS versions prior to 2018-07-25 Description The issue allows for XSS via the index.php?app=group&ac=create&ts=do endpoint, specifically through the groupdesc parameter. Recommendations For versions prior to 2018-07-25, avoid using the...

CVE-2018-15130: Improper Neutralization of Input During Web Page Generation

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter...

CVE-2018-15129: Improper Neutralization of Input During Web Page Generation

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter...

PT-2018-12886

Name of the Vulnerable Software and Affected Versions ThinkSAAS versions prior to 2018-07-25 Description The issue allows for XSS via the content parameter in the "index.php?app=article&ac=comment&ts=do" endpoint. Recommendations For versions prior to 2018-07-25, update to a version released afte...

Cross site request forgery (csrf)

An issue was discovered in WeaselCMS v0.3.5. CSRF can create new pages via an index.php?b=pages&a=new URI...

Cross site request forgery (csrf)

An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings such as the theme, title, and description via index.php...

CVE-2018-14958

An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings such as the theme, title, and description via index.php...

CVE-2018-14959

An issue was discovered in WeaselCMS v0.3.5. CSRF can create new pages via an index.php?b=pages&a=new URI...

CVE-2018-14958

An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings such as the theme, title, and description via index.php...

CVE-2018-14959: Cross-Site Request Forgery (CSRF)

An issue was discovered in WeaselCMS v0.3.5. CSRF can create new pages via an index.php?b=pages&a=new URI...

PT-2018-12834

Name of the Vulnerable Software and Affected Versions WeaselCMS version 0.3.5 Description An issue allows CSRF to update website settings, including theme, title, and description, via the "index.php" endpoint. Recommendations For WeaselCMS version 0.3.5, update to a newer version that contains a...

CVE-2018-14958: Cross-Site Request Forgery (CSRF)

An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings such as the theme, title, and description via index.php...

PT-2018-12835

Name of the Vulnerable Software and Affected Versions WeaselCMS version 0.3.5 Description An issue was discovered that allows CSRF to create new pages via an "index.php?b=pages&a=new" URI. Recommendations For WeaselCMS version 0.3.5, consider implementing proper CSRF protection mechanisms to...

Design/Logic Flaw

An issue was discovered in Rincewind 0.1. A reinstall vulnerability exists because the parameter p of index.php and another file named commonPages.php allows an attacker to reinstall the product, with all data reset...