CVE-2017-7359

Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack...

CVE-2017-7363

Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack...

CVE-2017-7360

CVE-2017-7360 affects Pixie 1.0.4. The connected documents identify a cross-site scripting vulnerability in the admin interface, specifically in the admin/index.php s=settings&x= parameter, indicating insufficient input validation in the settings handling path. The impact is an XSS where an attac...

CVE-2017-7361: Improper Neutralization of Input During Web Page Generation

Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack...

PT-2017-17682

Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows for an XSS attack through the admin/index.php page, specifically targeting the s=login&m= parameters. Recommendations For Pixie version 1.0.4, as a temporary workaround, consider restricting...

CVE-2017-7359: Improper Neutralization of Input During Web Page Generation

Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack...

PT-2017-17684

Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows for an XSS attack. The attack can be performed through the "s=publish&m=static&x=" parameter in the admin/index.php endpoint. Recommendations For Pixie version 1.0.4, update to a version that...

CVE-2017-7360: Improper Neutralization of Input During Web Page Generation

Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack...

PT-2017-17685

Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows for an XSS attack. The attack can be performed through the "s=publish&m=dynamic&x=" parameter in the admin/index.php endpoint. Recommendations For Pixie version 1.0.4, update to a version that...

PT-2017-17683

Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows for an XSS attack through the admin/index.php endpoint with specific settings. The attack is facilitated by the s and x parameters. Recommendations For Pixie version 1.0.4, as a temporary...

CVE-2017-7362: Improper Neutralization of Input During Web Page Generation

Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack...

PT-2017-17686

Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows for an XSS attack. The attack can be performed through the admin/index.php endpoint with specific parameters set, such as s=publish, m=module, and x. Recommendations For Pixie version 1.0.4, as ...

CVE-2017-7363: Improper Neutralization of Input During Web Page Generation

Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack...

CVE-2017-7321: Improper Control of Generation of Code

setup/controllers/welcome.php in MODX Revolution 2.5.4-pl and earlier allows remote attackers to execute arbitrary PHP code via the configkey parameter to the setup/index.php?action=welcome URI...

PT-2017-17665

Name of the Vulnerable Software and Affected Versions MODX Revolution versions 2.5.4-pl and earlier Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the config key parameter to the "setup/index.php?action=welcome" URI. Recommendations For MODX...

CVE-2017-6087

EyesOfNetwork "EON" 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selectedevents parameter in the 1 acknowledge, 2 delete, or 3 ownDisown function in module/monitoringged/gedfunctions.php or the 4 module parameter to module/index.php...

CVE-2017-6087: Improper Neutralization of Special Elements used in an OS Command

EyesOfNetwork "EON" 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selectedevents parameter in the 1 acknowledge, 2 delete, or 3 ownDisown function in module/monitoringged/gedfunctions.php or the 4 module parameter to module/index.php...

PT-2017-16886

Name of the Vulnerable Software and Affected Versions EyesOfNetwork versions 5.0 and earlier Description The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the selected events parameter. This can occur in the acknowledge, delete, or ownDisown functio...

Wonder CMS Path Traversal Vulnerability

Wonder CMS is an open source content management system CMS. A directory traversal vulnerability exists in the index.php file in Wonder CMS version 2014. A remote attacker can exploit this vulnerability to read arbitrary files with the help of a specially crafted theme...

Directory traversal

Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme...