PT-2018-4375

Name of the Vulnerable Software and Affected Versions Vesta Control Panel versions prior to 0.9.8-14 Description The issue allows remote authenticated users to execute arbitrary commands. This is achieved by using shell metacharacters in the backup parameter to the "/list/backup/index.php" API...

CVE-2018-7172

In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal...

CVE-2018-7172

In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal...

CVE-2018-7172: Improper Limitation of a Pathname to a Restricted Directory

In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal...

PT-2018-17928

Name of the Vulnerable Software and Affected Versions WonderCMS versions prior to 2.4.1 Description The issue allows remote attackers to delete arbitrary files via directory traversal in the index.php file. Recommendations For versions prior to 2.4.1, update to version 2.4.1 or later to resolve t...

nutten69.com XSS vulnerability

Open Bug Bounty ID: OBB-568923 Description| Value ---|--- Affected Website:| nutten69.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

PT-2018-18077

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.1.6 Description A remote code execution issue exists, allowing attackers to inject arbitrary PHP code via the timezone parameter in step 4 of a fresh installation procedure, specifically in the...

CVE-2018-7448: Improper Neutralization of Special Elements used in an OS Command

Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the "timezone" parameter in step 4 of a fresh installation procedure...

shogi.net XSS vulnerability

Open Bug Bounty ID: OBB-565102 Description| Value ---|--- Affected Website:| shogi.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-7219

application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...

Cross site request forgery (csrf)

application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...

PT-2018-6329

Name of the Vulnerable Software and Affected Versions: Userscape HelpSpot versions prior to 4.7.2 Description: A reflected cross-site scripting issue exists in the "return" parameter of the "index.php?pg=moderated" API endpoint. It executes when the return link is clicked. Recommendations: For...

CVE-2017-16755: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Userscape HelpSpot before 4.7.2. A reflected cross-site scripting vulnerability exists in the "return" parameter of the "index.php?pg=moderated" endpoint. It executes when the return link is clicked...

CVE-2017-16756: Cross-Site Request Forgery (CSRF)

An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index.php?pg=password.change" endpoint. This allows an attacker to change the password of another user's HelpSpot account...

PT-2018-17958

Name of the Vulnerable Software and Affected Versions NoneCms version 1.3.0 Description The issue allows for CSRF attacks, which can be used to perform actions such as changing an admin password or adding an account. This can be achieved by sending a request to the...

Code injection

trixbox 2.8.0.4 has XSS via the PATHINFO to /maint/index.php or /user/includes/language/langChooser.php...

CVE-2017-14536

trixbox 2.8.0.4 has XSS via the PATHINFO to /maint/index.php or /user/includes/language/langChooser.php...

CVE-2017-14536

CVE-2017-14536 affects the trixbox 2.8.0.4 release and is a cross-site scripting (XSS) vulnerability triggered via PATH_INFO to /maint/index.php or /user/includes/language/langChooser.php. The available data describe the vulnerability as an XSS flaw without details on exploitation steps, affected...

CVE-2017-14536

trixbox 2.8.0.4 has XSS via the PATHINFO to /maint/index.php or /user/includes/language/langChooser.php...

PT-2018-5680

Name of the Vulnerable Software and Affected Versions: trixbox version 2.8.0.4 Description: The issue is related to OS command injection via shell metacharacters in the lang parameter to the "/maint/modules/home/index.php" API endpoint. This allows for potential exploitation. Recommendations: For...