CVE-2018-12039

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring...

Sql injection

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring...

CVE-2018-12039

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring...

PT-2018-10960

Name of the Vulnerable Software and Affected Versions joyplus-cms version 1.6.0 Description The issue allows for Remote Code Execution due to an Arbitrary SQL command execution problem. This is caused by the use of a "/!select/" substring in place of a select substring in the manager/index.php...

CVE-2018-12039: Improper Neutralization of Special Elements used in an SQL Command

joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a "/!select/" substring in place of a select substring...

Cross site scripting

index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter...

CVE-2018-11735

index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter...

CVE-2018-11735: Improper Neutralization of Input During Web Page Generation

index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter...

PT-2018-10662

Name of the Vulnerable Software and Affected Versions YzmCMS versions 3.2 through 3.7 Description The issue concerns the forgotten-password feature in the index.php/member/reset/reset email.html file, which has a Response Discrepancy Information Exposure problem. Additionally, the verification co...

CVE-2018-11554: Exposure of Sensitive Information to an Unauthorized Actor

The forgotten-password feature in index.php/member/reset/resetemail.html in YzmCMS v3.2 through v3.7 has a Response Discrepancy Information Exposure issue and an unexpectedly long lifetime for a verification code, which makes it easier for remote attackers to hijack accounts via a brute-force...

PT-2018-10791

Name of the Vulnerable Software and Affected Versions Ximdex version 4.0 Description The issue concerns an XSS vulnerability. It can be triggered via the "index.php?action=createaccount" endpoint, specifically through the sname or fname parameters. Recommendations For Ximdex version 4.0, consider...

livrefoncier.fr XSS vulnerability

Open Bug Bounty ID: OBB-626506 Description| Value ---|--- Affected Website:| livrefoncier.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Flexit Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

GreenCMS 2.3.0603 - Cross-Site Request Forgery (Add Admin)

Exploit Title: GreenCMS v2.3.0603 CSRF vulnerability add admin Date: 2018-06-02 Exploit Author: xichao Vendor Homepage: https://github.com/GreenCMS/GreenCMS Software Link: https://github.com/GreenCMS/GreenCMS Version: v2.3.0603 CVE : CVE-2018-11671 An issue was discovered in GreenCMS v2.3.0603...

PT-2018-10743

Name of the Vulnerable Software and Affected Versions CmsEasy version 6.1 20180508 Description A CSRF issue allows adding an article via the /index.php?case=table&act=add&table=archive&admin dir=admin endpoint. Recommendations For CmsEasy version 6.1 20180508, as a temporary workaround, consider...

CVE-2018-11679: Cross-Site Request Forgery (CSRF)

An issue was discovered in CmsEasy 6.120180508. There is a CSRF vulnerability that can add an article via /index.php?case=table&act=add&table=archive&admindir=admin...

vehiculesutilitairesmag.com XSS vulnerability

Open Bug Bounty ID: OBB-625745 Description| Value ---|--- Affected Website:| vehiculesutilitairesmag.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Cross site request forgery (csrf)

An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php?m=admin&c=access&a=adduserhandle...

CVE-2018-11671

An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php?m=admin&c=access&a=adduserhandle...

CVE-2018-11670

An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary PHP code via the content parameter to index.php?m=admin&c=media&a=fileconnect...

PT-2018-10741

Name of the Vulnerable Software and Affected Versions GreenCMS version 2.3.0603 Description An issue was discovered that allows for a CSRF vulnerability, enabling the addition of an admin account via the "index.php?m=admin&c=access&a=adduserhandle" endpoint. Recommendations For GreenCMS version...