CVE-2018-10225

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

CVE-2018-10219

baijiacms V3 has physical path leakage via an index.php?mod=mobile&name=member&do=index request...

CVE-2018-10225

The thinkphp PHP-based web application development framework version 3.1.3 is vulnerable to SQL Injection . A remote attacker can exploit this by sending a specially crafted SQL statement via the index.php s parameter. Successful exploitation allows the attacker to view, add, change, or delete in...

CVE-2018-10225

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

CVE-2018-10219

CVE-2018-10219 affects baijiacms V3 and describes a physical path leakage exploitation via the request index.php?mod=mobile&name=member&do=index. Public sources (CNVD-2018-11709, NVD entry) attribute an information disclosure vulnerability to this path leakage, with the impact on confidentiality ...

CVE-2018-10224: Cross-Site Request Forgery (CSRF)

An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html...

CVE-2018-10225: Improper Neutralization of Special Elements used in an SQL Command

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

CVE-2018-10221: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WUZHI CMS V4.1.0. There is a persistent XSS vulnerability that can steal the administrator cookies via the tagtag parameter to the index.php?m=tags&f=index&v=add&&su=wuzhicms URI. After a website editor whose privilege is lower than the administrator logs in, he can add...

PT-2018-9765

Name of the Vulnerable Software and Affected Versions: YzmCMS version 3.8 Description: An issue was discovered that allows for a CSRF vulnerability, enabling the addition of an admin account via the "/index.php/admin/admin manage/add.html" API endpoint. Recommendations: For YzmCMS version 3.8,...

PT-2018-9767

Name of the Vulnerable Software and Affected Versions: thinkphp version 3.1.3 Description: The issue is related to SQL Injection, which can be exploited via the s parameter in the "index.php" endpoint. Recommendations: For thinkphp version 3.1.3, update to a newer version that contains a fix for...

CVE-2018-10219: Exposure of Sensitive Information to an Unauthorized Actor

baijiacms V3 has physical path leakage via an index.php?mod=mobile&name=member&do=index request...

PT-2018-9766

Name of the Vulnerable Software and Affected Versions: YzmCMS version 3.8 Description: A CSRF issue allows adding a tag via the "/index.php/admin/tag/add.html" API endpoint. Recommendations: For YzmCMS version 3.8, consider implementing CSRF protection measures to prevent unauthorized actions, su...

PT-2018-9761

Name of the Vulnerable Software and Affected Versions: baijiacms version V3 Description: The issue is related to physical path leakage. This can occur via a specific request to 'index.php?mod=mobile&name=member&do=index'. Recommendations: For baijiacms version V3, consider restricting access to t...

CVE-2018-10183

An issue was discovered in BigTree 4.2.22. There is cross-site scripting XSS in /core/inc/lib/less.php/test/index.php because of a $SERVER'REQUESTURI' echo, as demonstrated by the dir parameter in a file=charsets action...

PT-2018-9736

Name of the Vulnerable Software and Affected Versions: BigTree version 4.2.22 Description: The issue is related to cross-site scripting XSS in the /core/inc/lib/less.php/test/index.php file. This occurs due to the echo of the $ SERVER'REQUEST URI' variable. The vulnerability can be demonstrated b...

CVE-2018-10183: Improper Neutralization of Input During Web Page Generation

An issue was discovered in BigTree 4.2.22. There is cross-site scripting XSS in /core/inc/lib/less.php/test/index.php because of a $SERVER'REQUESTURI' echo, as demonstrated by the dir parameter in a file=charsets action...

Design/Logic Flaw

An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php...

CVE-2018-10128

An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php...

CVE-2018-10128

An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php...

Code injection

PbootCMS v0.9.8 allows PHP code injection via an IF label in index.php/About/6.html or admin.php/Site/index.html, related to the parserIfLabel function in \apps\home\controller\ParserController.php...