CVE-2018-8957: Improper Neutralization of Input During Web Page Generation

CoverCMS v1.1.6 has XSS via the fourth input box to index.php, related to admina/mconfigs.inc.php...

CVE-2018-8906

dsmall v20180320 has XSS via a crafted street address to public/index.php/home/memberaddress/index.html, which is mishandled at public/index.php/home/memberaddress/edit/addressid/2.html...

Code injection

dsmall v20180320 has XSS via a crafted street address to public/index.php/home/memberaddress/index.html, which is mishandled at public/index.php/home/memberaddress/edit/addressid/2.html...

CVE-2018-8906: Improper Neutralization of Input During Web Page Generation

dsmall v20180320 has XSS via a crafted street address to public/index.php/home/memberaddress/index.html, which is mishandled at public/index.php/home/memberaddress/edit/addressid/2.html...

CVE-2018-8805

Yxcms building system compatible cell phone v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extendguestbook.php or protected\apps\default\view\mobile\extendguestbook.php in an index.php?r=default/column/index&col=guestbook request...

PT-2018-18630

Name of the Vulnerable Software and Affected Versions Yxcms building system version 1.4.7 Description The issue concerns a security problem where an attacker can execute malicious scripts. This is achieved by exploiting the content parameter in specific PHP files, namely extend guestbook.php, whi...

CVE-2018-8805: Improper Neutralization of Input During Web Page Generation

Yxcms building system compatible cell phone v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extendguestbook.php or protected\apps\default\view\mobile\extendguestbook.php in an index.php?r=default/column/index&col=guestbook request...

CVE-2014-2274

Cross-site request forgery CSRF vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via a request to the...

CVE-2014-2297: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the VideoWhisper Live Streaming Integration plugin 4.29.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 n parameter to ls/htmlchat.php or 2 bgcolor parameter to ls/index.php. NOTE: vector 1 may overlap...

CVE-2014-2274: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Subscribe To Comments Reloaded plugin before 140219 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via a request to the...

PT-2018-4197

Name of the Vulnerable Software and Affected Versions VideoWhisper Live Streaming Integration plugin version 4.29.6 Description The issue allows remote attackers to inject arbitrary web script or HTML, which can lead to cross-site scripting XSS attacks. This is possible via the n parameter to...

PT-2018-4193

Name of the Vulnerable Software and Affected Versions Subscribe To Comments Reloaded plugin versions prior to 140219 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attack...

PT-2018-18616

Name of the Vulnerable Software and Affected Versions YzmCMS version 3.7.1 Description The issue concerns an eval injection in a specific PHP file, allowing remote attackers to execute arbitrary code. This is achieved by sending PHP code in the POST data of a particular request to...

CVE-2018-7474

An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php...

CVE-2018-7474

An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php...

CVE-2018-7474

An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php...

PT-2018-18090

Name of the Vulnerable Software and Affected Versions Textpattern CMS versions 4.6.2 and earlier Description An issue allows SQL code injection in the qty variable on the "index.php" page. Recommendations For Textpattern CMS versions 4.6.2 and earlier, update to a version later than 4.6.2 to...

CVE-2018-7474: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php...

www2.produktinfo.conrad.de XSS vulnerability

Open Bug Bounty ID: OBB-579604 Description| Value ---|--- Affected Website:| www2.produktinfo.conrad.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

TextPattern 4.6.2 - qty SQL Injection Vulnerability

Exploit for php platform in category web applications ============================================= MGC ALERT 2018-002 - Original release date: February 12, 2018 - Last revised: March 12, 2018 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score - CVE-ID: CVE-2018-7474...