13592 matches found
PT-2018-13240
Name of the Vulnerable Software and Affected Versions REDAXO CMS version 4.7.2 Description An issue was discovered that allows for a CSRF vulnerability, enabling the addition of an administrator account via the "index.php?page=user" endpoint. The page and user parameters are involved in this issu...
Twitter-Clone 1 - userid SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Twitter-Clone 1 - 'userid' SQL Injection Exploit Author: L0RD Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/ Version: 1 CVE: N/A Tested on: Win 10 POC : SQLi vulnerable files : follow.php , index.php vulnerable...
Twitter-Clone 1 - userid SQL Injection
Twitter-Clone 1 - userid SQL Injection Exploit Title: Twitter-Clone 1 - 'userid' SQL Injection Date: 2018-08-21 Exploit Author: L0RD Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/ Version: 1 CVE: N/A Tested on: Win 10 POC : SQLi vulnerable files : follow.php , index.php vulnerable...
CVE-2018-15203
An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/addpage allows a CSRF attack to add pages...
PT-2018-12925
Name of the Vulnerable Software and Affected Versions Gxlcms version 2.0 Description The issue allows for a CSRF attack, which can be used to add an administrator account through the news/index.php?s=Admin-Admin-Insert endpoint. Recommendations For Gxlcms version 2.0, consider implementing CSRF...
CVE-2018-15177: Cross-Site Request Forgery (CSRF)
In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account...
CVE-2018-15203: Cross-Site Request Forgery (CSRF)
An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/addpage allows a CSRF attack to add pages...
CVE-2018-15130
ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter...
CVE-2018-15130
ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter...
CVE-2018-15130
CVE-2018-15130 affects ThinkSAAS up to 2018-07-25. The vulnerability is a Cross-Site Scripting (XSS) flaw exploitable via the parameter groupdesc in the URL path index.php?app=group&ac=create&ts=do, allowing injection of arbitrary web script/HTML into the page. Root cause details beyond XSS are n...
CVE-2018-15129
ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter...
CVE-2018-15129
ThinkSAAS up to 2018-07-25 is affected by a cross-site scripting (XSS) flaw in the content parameter for the article comment endpoint (index.php?app=article&ac=comment&ts=do content). The issue arises from user-supplied content being reflected without proper sanitization, enabling XSS. Connected ...
PT-2018-12888
Name of the Vulnerable Software and Affected Versions ThinkSAAS versions prior to 2018-07-25 Description The issue allows for XSS via the index.php?app=group&ac=create&ts=do endpoint, specifically through the groupdesc parameter. Recommendations For versions prior to 2018-07-25, avoid using the...
CVE-2018-15130: Improper Neutralization of Input During Web Page Generation
ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter...
CVE-2018-15129: Improper Neutralization of Input During Web Page Generation
ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter...
PT-2018-12886
Name of the Vulnerable Software and Affected Versions ThinkSAAS versions prior to 2018-07-25 Description The issue allows for XSS via the content parameter in the "index.php?app=article&ac=comment&ts=do" endpoint. Recommendations For versions prior to 2018-07-25, update to a version released afte...
Cross site request forgery (csrf)
An issue was discovered in WeaselCMS v0.3.5. CSRF can create new pages via an index.php?b=pages&a=new URI...
Cross site request forgery (csrf)
An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings such as the theme, title, and description via index.php...
