Cross site request forgery (csrf)

index.php?m=member&v=pwreset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member...

CVE-2018-10311

A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the tagpinyin parameter to the /index.php?m=tags&f=index&v=add URI...

CVE-2018-10312

index.php?m=member&v=pwreset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member...

CVE-2018-10313: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq10%5D parameter to the /index.php?m=member&f=index&v=profile&setiframe=1 URI...

CVE-2018-10329: Improper Neutralization of Input During Web Page Generation

app/tools/mac-lookup/index.php in phpIPAM 1.3.1 has Reflected XSS on /tools/mac-lookup/ via the mac parameter...

CVE-2018-10312: Cross-Site Request Forgery (CSRF)

index.php?m=member&v=pwreset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member...

Cross site request forgery (csrf)

An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI...

johnleary.com XSS vulnerability

Open Bug Bounty ID: OBB-606065 Description| Value ---|--- Affected Website:| johnleary.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-10267

WTCMS 1.0 is affected by a CSRF vulnerability that allows an attacker to add an administrator account using the URI index.php?admin&m=user&a=add_post. Root cause: CSRF in the admin-user creation flow. Impact: attacker could elevate privileges by creating an admin account; no exploitation details ...

CVE-2018-10265: Cross-Site Request Forgery (CSRF)

An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI...

PT-2018-9795

Name of the Vulnerable Software and Affected Versions: HongCMS version 3.0.0 Description: An issue was discovered that allows for a CSRF vulnerability, enabling the addition of an administrator account via the "admin/index.php/users/save" URI. Recommendations: For HongCMS version 3.0.0, update to...

CVE-2018-10267: Cross-Site Request Forgery (CSRF)

WTCMS 1.0 has a CSRF vulnerability to add an administrator account via the index.php?admin&m=user&a=addpost URI...

CVE-2018-10248

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can delete any article via index.php?m=content&f=content&v=recycledelete...

CVE-2018-10248: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can delete any article via index.php?m=content&f=content&v=recycledelete...

PT-2018-9782

Name of the Vulnerable Software and Affected Versions: baijiacms V3 Description: The issue allows for CSRF via the "index.php?mod=site&op=edituser&name=manager&do=user" API endpoint to add an administrator account. Recommendations: For baijiacms V3, as a temporary workaround, consider restricting...

CVE-2018-10249: Cross-Site Request Forgery (CSRF)

baijiacms V3 has CSRF via index.php?mod=site&op=edituser&name=manager&do=user to add an administrator account...

CVE-2018-10225

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

Sql injection

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

CVE-2018-10219

baijiacms V3 has physical path leakage via an index.php?mod=mobile&name=member&do=index request...

CVE-2018-10221

An issue was discovered in WUZHI CMS V4.1.0. There is a persistent XSS vulnerability that can steal the administrator cookies via the tagtag parameter to the index.php?m=tags&f=index&v=add&&su=wuzhicms URI. After a website editor whose privilege is lower than the administrator logs in, he can add...