161 matches found
PT-2019-9012
Name of the Vulnerable Software and Affected Versions ImpressCMS version 1.3.10 Description The issue concerns a cross-site scripting XSS problem. It occurs via the PATH INFO to specific endpoints, including "htdocs/install/index.php", "htdocs/install/page langselect.php", or "htdocs/install/page...
PT-2019-18686
Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description A stored Cross-site Scripting XSS issue was found. The username parameter of the "/install/index.php" page is vulnerable. This can be demonstrated via the "admin/login.php" page. Recommendations For PHPMyWind...
CVE-2019-7660: Improper Neutralization of Input During Web Page Generation
An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site Scripting XSS vulnerability, as demonstrated by admin/login.php...
CVE-2018-20567: Incorrect Permission Assignment for Critical Resource
An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic circumstances in which install.lock cannot be read...
PT-2018-15437
Name of the Vulnerable Software and Affected Versions DouPHP version 1.5 20181221 Description An issue was discovered in DouCo DouPHP, where the /install/index.php endpoint allows a reload of the product under certain circumstances when the install.lock file cannot be read. Recommendations For...
PT-2018-15384
Name of the Vulnerable Software and Affected Versions Frog CMS version 0.9.5 Description The issue allows for XSS via the Database name field to the "/install/index.php" API endpoint. Recommendations For Frog CMS version 0.9.5, update to a version that fixes this issue, as using the Database name...
CVE-2018-20448: Improper Neutralization of Input During Web Page Generation
Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI...
CVE-2018-17036
An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...
CVE-2018-17034
UCMS 1.4.6 has XSS via the install/index.php mysqldbname parameter...
CVE-2018-17034
UCMS 1.4.6 contains a Cross-Site Scripting (XSS) vulnerability controllable via the mysql_dbname parameter in install/index.php. Multiple connected sources (NVD entry CVE-2018-17034 and CNVD/CVE listings) confirm an XSS flaw capable of injecting arbitrary scripts/HTML in affected users’ browsers....
CVE-2018-17035
The vulnerability CVE-2018-17035 affects UCMS 1.4.6, where an SQL injection can occur during installation via the install/index.php mysql_dbname parameter. Affected component is UCMS (PHP-based CMS); root cause is unsafely handled mysql_dbname input during setup, enabling potential SQL command ex...
PT-2018-13851
Name of the Vulnerable Software and Affected Versions UCMS version 1.4.6 Description The issue is related to SQL injection that occurs during the installation process. Specifically, the mysql dbname parameter in the install/index.php endpoint is vulnerable. Recommendations For version 1.4.6, avoi...
PT-2018-13850
Name of the Vulnerable Software and Affected Versions UCMS version 1.4.6 Description The issue is related to a security problem where an attacker can execute malicious scripts. This is possible due to the lack of proper input validation in the mysql dbname parameter of the install/index.php file...
CVE-2018-17036: Improper Control of Generation of Code
An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...
CVE-2018-17035: Improper Neutralization of Special Elements used in an SQL Command
UCMS 1.4.6 has SQL injection during installation via the install/index.php mysqldbname parameter...
CVE-2018-17034: Improper Neutralization of Input During Web Page Generation
UCMS 1.4.6 has XSS via the install/index.php mysqldbname parameter...
PT-2018-13852
Name of the Vulnerable Software and Affected Versions UCMS versions 1.4.6 through 1.6 Description An issue allows PHP code injection during installation via the systemdomain parameter to "install/index.php", as demonstrated by injecting a phpinfo call into /inc/config.php. Recommendations For UCM...
CVE-2018-10570
Frog CMS 0.9.5 has XSS in /install/index.php via the 'config''adminusername' field...
PT-2018-9968
Name of the Vulnerable Software and Affected Versions: Frog CMS version 0.9.5 Description: The issue concerns a security problem where an attacker can inject malicious code. The estimated number of potentially affected devices is not provided. The problem can be exploited through the...