Cross site scripting

An issue was discovered in Rincewind 0.1. There is a cross-site scripting XSS vulnerability involving a p=account request to index.php and another file named commonPages.php...

CVE-2018-14873

An issue was discovered in Rincewind 0.1. There is a cross-site scripting XSS vulnerability involving a p=account request to index.php and another file named commonPages.php...

CVE-2018-14873

An issue was discovered in Rincewind 0.1. There is a cross-site scripting XSS vulnerability involving a p=account request to index.php and another file named commonPages.php...

CVE-2018-14873: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Rincewind 0.1. There is a cross-site scripting XSS vulnerability involving a p=account request to index.php and another file named commonPages.php...

CVE-2018-14872: Improper Input Validation

An issue was discovered in Rincewind 0.1. A reinstall vulnerability exists because the parameter p of index.php and another file named commonPages.php allows an attacker to reinstall the product, with all data reset...

CVE-2018-14873

An issue was discovered in Rincewind 0.1. There is a cross-site scripting XSS vulnerability involving a p=account request to index.php and another file named commonPages.php...

PT-2018-12773

Name of the Vulnerable Software and Affected Versions Rincewind version 0.1 Description A cross-site scripting XSS issue was found, involving a request to "index.php" and "commonPages.php". This issue can be exploited through a 'p=account' request. Recommendations For Rincewind version 0.1,...

CVE-2018-14873

CVE-2018-14873 affects the Rincewind 0.1 CMS. The issue is a cross-site scripting (XSS) vulnerability triggered by a p=account request to index.php and to commonPages.php. The connected documents do not provide exploitation details, impact metrics beyond generic XSS, or any remediation/patch info...

CVE-2018-14872

An issue was discovered in Rincewind 0.1. A reinstall vulnerability exists because the parameter p of index.php and another file named commonPages.php allows an attacker to reinstall the product, with all data reset...

PT-2018-12772

Name of the Vulnerable Software and Affected Versions Rincewind version 0.1 Description A reinstall issue exists due to the parameter p in index.php and commonPages.php, allowing an attacker to reinstall the product and reset all data. Recommendations For Rincewind version 0.1, avoid using the...

Design/Logic Flaw

An issue was discovered in DataLife Engine DLE through 13.0. An attacker can use XSS related to the /addnews.html and /index.php?do=addnews URIs to send a malicious script to unsuspecting Admins or users...

CVE-2018-14777: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DataLife Engine DLE through 13.0. An attacker can use XSS related to the /addnews.html and /index.php?do=addnews URIs to send a malicious script to unsuspecting Admins or users...

PT-2018-12716

Name of the Vulnerable Software and Affected Versions DataLife Engine versions prior to 13.0 Description An issue was discovered that allows an attacker to use XSS to send a malicious script to unsuspecting Admins or users, related to the "/addnews.html" and "/index.php?do=addnews" API Endpoints...

PT-2018-12659

Name of the Vulnerable Software and Affected Versions Gxlcms version 1.1.4 Description The issue allows remote attackers to read arbitrary files. This is related to a crafted request to the "index.php?s=Admin-Tpl-ADD-id" endpoint, specifically targeting the add function in the TplAction.class.php...

CVE-2018-14685: Exposure of Sensitive Information to an Unauthorized Actor

The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitrary files via a crafted index.php?s=Admin-Tpl-ADD-id request, related to Lib/Common/Admin/function.php...

Cross site request forgery (csrf)

index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account...

CVE-2018-14582

index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account...

CVE-2018-14582: Cross-Site Request Forgery (CSRF)

index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account...

PT-2018-12592

Name of the Vulnerable Software and Affected Versions BageCMS version 3.1.3 Description The issue allows for CSRF to add a background administrator account through the "index.php?r=admini/admin/create" endpoint. Recommendations For BageCMS version 3.1.3, consider implementing CSRF protection...

Cross site scripting

An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formnickname parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the "system settings - mail server"...