CVE-2018-11671: Cross-Site Request Forgery (CSRF)

An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php?m=admin&c=access&a=adduserhandle...

PT-2018-10740

Name of the Vulnerable Software and Affected Versions GreenCMS version 2.3.0603 Description A CSRF issue allows attackers to execute arbitrary PHP code via the content parameter to "index.php?m=admin&c=media&a=fileconnect" API endpoint. Recommendations For GreenCMS version 2.3.0603, as a temporar...

CVE-2018-11670: Cross-Site Request Forgery (CSRF)

An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary PHP code via the content parameter to index.php?m=admin&c=media&a=fileconnect...

Cross site scripting

DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" newlastname parameter...

CVE-2018-11559

DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" newlastname parameter...

CVE-2018-11559

DomainMod 4.10.0 is affected by a Stored XSS in the profile settings endpoint (/settings/profile/index.php) via the new_last_name parameter. Root cause: persistent injection in the user profile handling leading to script execution when viewed. Impact is limited to what the XSS allows per the sour...

CVE-2018-11558

CVE-2018-11558 is a stored XSS vulnerability in DomainMod 4.10.0, exploiting the new_first_name parameter in the "/settings/profile/index.php" page. The connected documents consistently describe the issue as a cross-site scripting flaw affecting DomainMod 4.10.0, with multiple sources naming the ...

CVE-2018-11558

DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" newfirstname parameter...

CVE-2018-11558: Improper Neutralization of Input During Web Page Generation

DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" newfirstname parameter...

PT-2018-10667

Name of the Vulnerable Software and Affected Versions DomainMod version 4.10.0 Description The issue concerns a Stored XSS in the "/settings/profile/index.php" new last name parameter. Recommendations For DomainMod version 4.10.0, avoid using the new last name parameter in the...

PT-2018-10666

Name of the Vulnerable Software and Affected Versions DomainMod version 4.10.0 Description The issue concerns a Stored XSS in the "/settings/profile/index.php" new first name parameter. Recommendations For DomainMod version 4.10.0, update to a version that fixes this issue, as using the new first...

CVE-2018-11495

OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\model\catalog\download.php via admin/index.php?route=catalog/download/edit, related to the downloadid. For example, an attacker can download ../../config.php...

CVE-2018-11493

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a friendship link via index.php?m=link&f=index&v=add...

CVE-2018-11493

WUZHI CMS 4.1.0 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that can add a friendship link via index.php?m=link&f=index&v=add. The issue is documented under CVE-2018-11493. Connected sources confirm the affected software/version and the specific vulnerable endpoint. The exist...

CVE-2018-11493: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a friendship link via index.php?m=link&f=index&v=add...

CVE-2018-11495: Improper Limitation of a Pathname to a Restricted Directory

OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\model\catalog\download.php via admin/index.php?route=catalog/download/edit, related to the downloadid. For example, an attacker can download ../../config.php...

PT-2018-10593

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns a session management problem in the Administrations Tab of Monstra CMS. Specifically, changing a password at the "admin/index.php?id=users&action=edit&user id=1" endpoint does not...

CVE-2018-11472: Improper Neutralization of Input During Web Page Generation

Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...

PT-2018-10591

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns a Reflected XSS that occurs during the login process, specifically involving the login parameter to the admin/index.php endpoint. Recommendations For Monstra CMS version 3.0.4, update to...

juwelier-petersen.de XSS vulnerability

Open Bug Bounty ID: OBB-620002 Description| Value ---|--- Affected Website:| juwelier-petersen.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...