Design/Logic Flaw

joyplus-cms 1.6.0 has XSS in adminplayer.php, related to manager/index.php "system manage" and "add" actions...

CVE-2018-12905

joyplus-cms 1.6.0 has XSS in adminplayer.php, related to manager/index.php "system manage" and "add" actions...

PT-2018-11469

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description A SQL Injection issue was discovered in the admin/controllers/database.php file. The issue can be exploited via the "admin/index.php/database/operate?dbaction=emptytable&tablename=" URI, allowing for potential...

CVE-2018-12909: Improper Limitation of a Pathname to a Restricted Directory

Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem that the webserver user has access to via an index.php?op=fileviewer&file= URI. NOTE: the vendor indicates that the product is not intended for a "publicly accessible environment...

CVE-2018-12905: Improper Neutralization of Input During Web Page Generation

joyplus-cms 1.6.0 has XSS in adminplayer.php, related to manager/index.php "system manage" and "add" actions...

CVE-2018-12912: Improper Neutralization of Special Elements used in an SQL Command

An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI...

PT-2018-11463

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue is related to an XSS in the admin player.php file, specifically with the "system manage" and "add" actions in the manager/index.php file. Recommendations For joyplus-cms version 1.6.0, consider...

CVE-2018-12658

Reflected Cross-Site Scripting XSS exists in the Stock Take module in SLiMS 8 Akasia 8.3.1 via an admin/modules/stocktake/index.php?keywords= URI...

CVE-2018-12658: Improper Neutralization of Input During Web Page Generation

Reflected Cross-Site Scripting XSS exists in the Stock Take module in SLiMS 8 Akasia 8.3.1 via an admin/modules/stocktake/index.php?keywords= URI...

CVE-2018-12656: Improper Neutralization of Input During Web Page Generation

Reflected Cross-Site Scripting XSS exists in the Membership module in SLiMS 8 Akasia 8.3.1 via an admin/modules/membership/index.php?keywords= URI...

phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion Vulnerability

Exploit for php platform in category web applications The latest version downloaded from the official website, the file name is phpMyAdmin-4.8.1-all-languages.zip The problem appears in /index.php Find 5563 lines Line 61 contains include $REQUEST'target'; This is obviously LFI precursor, as long ...

PT-2018-11309

Name of the Vulnerable Software and Affected Versions SLiMS versions 8.3.1 Description A Reflected Cross-Site Scripting issue exists in the Bibliography module. This is due to insufficient input validation in the keywords parameter of the /admin/modules/bibliography/index.php API endpoint...

phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (1)

phpMyAdmin 4.8.1 - Authenticated Local File Inclusion 1 The latest version downloaded from the official website, the file name is phpMyAdmin-4.8.1-all-languages.zip The problem appears in /index.php Find 5563 lines Line 61 contains include $REQUEST'target'; This is obviously LFI precursor, as lon...

crosshop.eu XSS vulnerability

Open Bug Bounty ID: OBB-634645 Description| Value ---|--- Affected Website:| crosshop.eu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-12583

An issue was discovered in AKCMS 6.1. CSRF can delete an article via an admincp deleteitem action to index.php...

CVE-2018-12583

An issue was discovered in AKCMS 6.1. CSRF can delete an article via an admincp deleteitem action to index.php...

CVE-2018-12583

AKCMS 6.1 is affected by a cross-site request forgery (CSRF) that can delete articles via the admincp deleteitem action to index.php. The vulnerability is described in CVE-2018-12583 and corroborated by CNVD-2018-14261 and related records, which state an attacker could exploit CSRF to delete arti...

CVE-2018-12583: Cross-Site Request Forgery (CSRF)

An issue was discovered in AKCMS 6.1. CSRF can delete an article via an admincp deleteitem action to index.php...

PT-2018-11268

Name of the Vulnerable Software and Affected Versions AKCMS version 6.1 Description An issue was discovered that allows CSRF to add an admin account via the "/index.php?file=account&action=manageaccounts&job=newaccount" API endpoint. Recommendations For AKCMS version 6.1, consider disabling the...

PT-2018-10407

Name of the Vulnerable Software and Affected Versions Artica Pandora FMS versions prior to 7.0 NG 723 Description The issue allows an attacker to execute arbitrary code via a crafted refr parameter in a "/pandora console/index.php?sec=estado&sec2=operation/agentes/estado agente&refr=" call...