CVE-2018-14399: Improper Control of Generation of Code

libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php.jpg URI in the SRC attribute of an IMG element within infocontent JSON data to the index.php?m=member&c=index&a=register URI...

CVE-2018-14422: Improper Neutralization of Input During Web Page Generation

blog/index.php in SansCMS 0.7 has XSS via the q parameter...

PT-2018-12504

Name of the Vulnerable Software and Affected Versions SansCMS version 0.7 Description The issue is related to a security problem where an attacker can inject malicious code. This is possible due to insufficient input validation in the q parameter of the 'blog/index.php' endpoint. Recommendations...

CVE-2018-14420: Cross-Site Request Forgery (CSRF)

MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=adminadmin&a=doaddsave URI...

PT-2018-12502

Name of the Vulnerable Software and Affected Versions MetInfo version 6.0.0 Description The issue allows for a CSRF attack, enabling the addition of a user account through a doaddsave action to admin/index.php. This can be achieved by accessing a specific URI, such as...

CVE-2018-14331: Cross-Site Request Forgery (CSRF)

An issue was discovered in XiaoCms X1 v20140305. There is a CSRF vulnerability to change the administrator account password via admin/index.php?c=index&a=my...

PT-2018-12446

Name of the Vulnerable Software and Affected Versions XiaoCms X1 version v20140305 Description An issue was discovered that allows for a CSRF vulnerability, enabling an attacker to change the administrator account password via the "admin/index.php?c=index&a=my" API endpoint. Recommendations For...

OpenSID Cross-Site Request Forgery Vulnerability

OpenSID is a village information management system developed by the SID community. A cross-site request forgery vulnerability exists in index.php/manuser/insert URI in OpenSID version 18.06-pasca, which can be exploited by an attacker to add an administrator-level account...

Weblication CMS Core & Grid '/grid5/scripts/' module cross-site scripting vulnerability

Weblication CMS Core & Grid is a content management system CMS that supports drag-and-drop website creation. A cross-site scripting vulnerability exists in the wFilemanager.php and index.php files of the '/grid5/scripts/' module in Weblication CMS Core & Grid version 12.6.24. A remote attacker ca...

torontohealthprofiles.ca XSS vulnerability

Open Bug Bounty ID: OBB-639591 Description| Value ---|--- Affected Website:| torontohealthprofiles.ca Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-13039

OpenSID 18.06-pasca has reflected Cross Site Scripting XSS via the cari parameter, aka an index.php/first?cari= URI...

CVE-2018-13040

OpenSID 18.06-pasca has a CSRF vulnerability. This vulnerability can add an account at the admin level via the index.php/manuser/insert URI...

CVE-2018-13039

OpenSID 18.06-pasca has reflected Cross Site Scripting XSS via the cari parameter, aka an index.php/first?cari= URI...

CVE-2018-13040

OpenSID 18.06-pasca has a CSRF vulnerability. This vulnerability can add an account at the admin level via the index.php/manuser/insert URI...

PT-2018-11553

Name of the Vulnerable Software and Affected Versions OpenSID version 18.06-pasca Description The issue is related to reflected Cross Site Scripting XSS that can be triggered via the cari parameter in an index.php/first?cari= URI. This allows for potential malicious script injection...

CVE-2018-13040: Cross-Site Request Forgery (CSRF)

OpenSID 18.06-pasca has a CSRF vulnerability. This vulnerability can add an account at the admin level via the index.php/manuser/insert URI...

PT-2018-11554

Name of the Vulnerable Software and Affected Versions OpenSID version 18.06-pasca Description The issue allows an attacker to add an account at the admin level. This is achieved via the "index.php/man user/insert" API endpoint. Recommendations For OpenSID version 18.06-pasca, consider restricting...

CVE-2018-13039: Improper Neutralization of Input During Web Page Generation

OpenSID 18.06-pasca has reflected Cross Site Scripting XSS via the cari parameter, aka an index.php/first?cari= URI...

CVE-2018-13002

An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the wFilemanager.php and index.php files of the /grid5/scripts/ modules. The injection point is located in the Project Title and the execution point occurs in the Inhaltsprojekt...

CVE-2018-13010

WSTMall v1.9.1_170316 is affected by a Cross-Site Request Forgery (CSRF) that can be exploited via the URL index.php?m=Admin&c=Users&a=edit to add a user account. The CVE-2018-13010 entry is corroborated by multiple sources (NVD entry and CNVD/Red Hat/PRION mirrors) describing CSRF to create new ...