X (Formerly Twitter): Multiple XSS on account settings that can hijack any users in the company.

Note: Hello Twitter Team, I just noticed that my report 485748 is already fixed, can you confirm? but my other duplicate reports aren't and still exists. 492444 492913 are you sure it's on the same root cause? because I think the broad fix is already released but didn't fix the other issues. I wi...

PT-2019-18650

Name of the Vulnerable Software and Affected Versions Waimai Super Cms version 20150505 Description An issue was discovered that allows for XSS via the username or password parameter in the "admin.php?m=Member&a=adminaddsave" API endpoint. Recommendations For Waimai Super Cms version 20150505,...

WordPress Ultimate-Member 2.0.38 Cross Site Request Forgery / Shell Upload

Exploit Title : WordPress Ultimate-Member Plugins 2.0.38 CSRF Shell Upload Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 05/02/2019 Vendor Homepage : ultimatemember.com Software Download Link : downloads.wordpress.org/plugin/ultimate-member.2.0.38.zip Software...

CVE-2019-5725

qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file...

CVE-2019-5725

qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file...

PT-2019-17833

Name of the Vulnerable Software and Affected Versions qibosoft versions through V7 Description The issue allows remote attackers to read arbitrary files via the main parameter in member/index.php, which can be exploited through Server-Side Request Forgery SSRF to read sensitive files, such as .sq...

CVE-2019-5725: Server-Side Request Forgery (SSRF)

qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file...

CVE-2019-5488

EARCLINK ESPCMS-P8 has SQL injection in the installpack/index.php?ac=Member&at=verifyAccount verifykey parameter. installpack/espcmspublic/espcmsdb.php may allow retrieving sensitive information from the ESPCMS database...

Sql injection

EARCLINK ESPCMS-P8 has SQL injection in the installpack/index.php?ac=Member&at=verifyAccount verifykey parameter. installpack/espcmspublic/espcmsdb.php may allow retrieving sensitive information from the ESPCMS database...

CVE-2019-5488

EARCLINK ESPCMS-P8 has SQL injection in the installpack/index.php?ac=Member&at=verifyAccount verifykey parameter. installpack/espcmspublic/espcmsdb.php may allow retrieving sensitive information from the ESPCMS database...

CVE-2018-20603

Lei Feng TV CMS aka LFCMS 3.8.6 allows admin.php?s=/Member/add.html CSRF...

PT-2018-15467

Name of the Vulnerable Software and Affected Versions Lei Feng TV CMS aka LFCMS version 3.8.6 Description The issue allows for a CSRF attack on the admin.php?s=/Member/add.html endpoint. Recommendations For Lei Feng TV CMS aka LFCMS version 3.8.6, consider implementing CSRF protection measures,...

CVE-2018-20424

Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to delete the commonmemberwechatmp data structure via an ac=unbindmp request to plugin.php...

CVE-2018-20300

Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this code is injected into a memberform.$fid.php file...

CVE-2018-20012

PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI...

Input validation

PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI...

CVE-2018-20012

PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI...

CVE-2018-20012

PHPCMF 4.1.3 is affected by an XSS vulnerability reachable through the first input field of index.php?s=member&c=register&m=index. The issue allows injection of script via the input and could impact users loading the page. No remediation details are provided in the supplied documents.

Sales & Company Management System Cross-Site Scripting Vulnerability

Sales & Company Management System SCMS is a sales and company management system. The system includes features such as customer management, product management and tax management. A cross-site scripting vulnerability exists in the memberemail.php file in SCMS 2018-06-06 and prior versions, which ca...

PT-2018-15236

Name of the Vulnerable Software and Affected Versions PHPCMF version 4.1.3 Description The issue is related to a security problem where an attacker can inject malicious code. The problem occurs via the first input field to the "index.php?s=member&c=register&m=index" URI, allowing for malicious co...