PT-2018-12659

Name of the Vulnerable Software and Affected Versions Gxlcms version 1.1.4 Description The issue allows remote attackers to read arbitrary files. This is related to a crafted request to the "index.php?s=Admin-Tpl-ADD-id" endpoint, specifically targeting the add function in the TplAction.class.php...

CVE-2018-14685: Exposure of Sensitive Information to an Unauthorized Actor

The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitrary files via a crafted index.php?s=Admin-Tpl-ADD-id request, related to Lib/Common/Admin/function.php...

Cross site request forgery (csrf)

index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account...

CVE-2018-14582

index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account...

CVE-2018-14582: Cross-Site Request Forgery (CSRF)

index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account...

PT-2018-12592

Name of the Vulnerable Software and Affected Versions BageCMS version 3.1.3 Description The issue allows for CSRF to add a background administrator account through the "index.php?r=admini/admin/create" endpoint. Recommendations For BageCMS version 3.1.3, consider implementing CSRF protection...

Cross site scripting

An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formnickname parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the "system settings - mail server"...

CVE-2018-14515

A SQL injection was discovered in WUZHI CMS 4.1.0 that allows remote attackers to inject a malicious SQL statement via the index.php?m=promote&f=index&v=search keywords parameter...

CVE-2018-14515

CVE-2018-14515 affects WUZHI CMS 4.1.0 and enables a remote SQL injection through the parameter in the URL index.php?m=promote&f=index&v=search keywords. Public reports describe an injection vector in the search keywords field, allowing attacker-controlled SQL statements. NVD lists CVSSv2 base sc...

CVE-2018-14515: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection was discovered in WUZHI CMS 4.1.0 that allows remote attackers to inject a malicious SQL statement via the index.php?m=promote&f=index&v=search keywords parameter...

CVE-2018-14512: Improper Neutralization of Input During Web Page Generation

An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formnickname parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the "system settings - mail server"...

CVE-2018-14513: Improper Neutralization of Input During Web Page Generation

An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formcontent parameter to the index.php?m=feedback&f=index&v=contact URI...

PT-2018-12559

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A SQL injection issue was found that allows remote attackers to inject malicious SQL statements via the "index.php?m=promote&f=index&v=search keywords" parameter. Recommendations For WUZHI CMS version 4.1.0,...

PT-2018-12557

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A persistent XSS issue was found, allowing remote attackers to inject arbitrary web script or HTML via the formcontent parameter to the "index.php?m=feedback&f=index&v=contact" API endpoint. Recommendations...

zachskruer.no XSS vulnerability

Open Bug Bounty ID: OBB-651867 Description| Value ---|--- Affected Website:| zachskruer.no Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-14420

MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=adminadmin&a=doaddsave URI...

CVE-2018-14422

blog/index.php in SansCMS 0.7 has XSS via the q parameter...

Cross site request forgery (csrf)

SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address aka vpic to /admin/adminvideo.php aka /backend/adminvideo.php. The code is executed by visiting /details/index.php. This can also be exploited through CSRF...

Cross site request forgery (csrf)

MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=adminadmin&a=doaddsave URI...

CVE-2018-14422

blog/index.php in SansCMS 0.7 has XSS via the q parameter...