CVE-2018-10128

An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php...

CVE-2018-10128

XYHCMS 3.5 is affected by a Cross-Site Scripting (XSS) vulnerability via the test parameter to index.php. Multiple sources (CNVD-2018-07980, RH:CVE-2018-10128, NVD/CVE-2018-10128, OSV, CNVD) describe an XSS that can execute JavaScript and is exploitable through the index.php?test parameter. The r...

Cross site scripting

Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php...

PT-2018-9698

Name of the Vulnerable Software and Affected Versions: XYHCMS version 3.5 Description: An issue was discovered that allows CSRF via an "index.php?g=Manage&m=Rbac&a=addUser" request, resulting in the addition of an account with the administrator role. Recommendations: For XYHCMS version 3.5,...

CVE-2018-10128: Improper Neutralization of Input During Web Page Generation

An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php...

CVE-2018-10127: Cross-Site Request Forgery (CSRF)

An issue was discovered in XYHCMS 3.5. It has CSRF via an index.php?g=Manage&m=Rbac&a=addUser request, resulting in addition of an account with the administrator role...

PT-2018-9699

Name of the Vulnerable Software and Affected Versions: XYHCMS version 3.5 Description: An issue was discovered that allows XSS via the test parameter to the "index.php" endpoint. Recommendations: For XYHCMS version 3.5, consider restricting access to the test parameter in the "index.php" endpoint...

CVE-2018-10133: Improper Control of Generation of Code

PbootCMS v0.9.8 allows PHP code injection via an IF label in index.php/About/6.html or admin.php/Site/index.html, related to the parserIfLabel function in \apps\home\controller\ParserController.php...

PT-2018-9701

Name of the Vulnerable Software and Affected Versions: PbootCMS version 0.9.8 Description: The issue allows PHP code injection via an IF label in specific endpoints, such as "index.php/About/6.html" or "admin.php/Site/index.html". This is related to the parserIfLabel function in the...

CVE-2018-10118

Monstra CMS 3.0.4 is affected by a Stored XSS in the Name field on the Create New Page screen (admin/index.php?id=pages), related to plugins/box/pages/pages.admin.php. This CVE details the vulnerable component path and the input point that leads to script execution. The connected data confirms th...

CVE-2018-10118

Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php...

CVE-2018-10118: Improper Neutralization of Input During Web Page Generation

Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php...

PT-2018-9692

Name of the Vulnerable Software and Affected Versions: Monstra CMS version 3.0.4 Description: The issue is related to a Stored XSS in the Name field on the Create New Page screen, accessible under the "admin/index.php?id=pages" URI, and is associated with the plugins/box/pages/pages.admin.php fil...

PT-2018-9693

Name of the Vulnerable Software and Affected Versions: Monstra CMS version 3.0.4 Description: The issue concerns a stored XSS vulnerability. An attacker with access to the editor role can exploit this by entering a malicious payload in the title section of the "Edit 404 page" action, which is...

CVE-2018-10082: Exposure of Sensitive Information to an Unauthorized Actor

CMS Made Simple CMSMS through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or...

PT-2018-9667

Name of the Vulnerable Software and Affected Versions: CMS Made Simple CMSMS versions prior to 2.2.8 Description: The issue allows physical path leakage through various means, including an invalid page value in the /index.php?page= parameter, a crafted URI starting with /index.php?mact=Search, or...

CVE-2017-9838

Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting XSS vulnerabilities in versions before 5.0.4: index.php leftmenu parameter, core/ajax/box.php PATHINFO, product/stats/card.php type parameter, holiday/list.php monthcreate, monthstart, and monthend parameters, and don/card.ph...

CVE-2017-9838

Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting XSS vulnerabilities in versions before 5.0.4: index.php leftmenu parameter, core/ajax/box.php PATHINFO, product/stats/card.php type parameter, holiday/list.php monthcreate, monthstart, and monthend parameters, and don/card.ph...

CVE-2017-9838: Improper Neutralization of Input During Web Page Generation

Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting XSS vulnerabilities in versions before 5.0.4: index.php leftmenu parameter, core/ajax/box.php PATHINFO, product/stats/card.php type parameter, holiday/list.php monthcreate, monthstart, and monthend parameters, and don/card.ph...

PT-2018-8541

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM versions prior to 5.0.4 Description The issue concerns multiple reflected Cross-Site Scripting XSS vulnerabilities. The affected API endpoints and parameters include: "index.php" with the leftmenu parameter, "core/ajax/box.php...