4669 matches found
Cross site scripting
DedeCMS 5.7 SP2 allows XSS via the /member/uploadsselect.php f or keyword parameter...
Cross site scripting
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter...
CVE-2018-18781
DedeCMS 5.7 SP2 is affected by a cross-site scripting (XSS) vulnerability in the /member/uploads_select.php endpoint, exploitable via the keyword parameter. The issue is caused by improper handling of input in that parameter, enabling injection of arbitrary scripts. The CVE-2018-18781 entry is co...
CVE-2018-18781
DedeCMS 5.7 SP2 allows XSS via the /member/uploadsselect.php f or keyword parameter...
CVE-2018-18782: Improper Neutralization of Input During Web Page Generation
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/myfriend.php ftype parameter...
PT-2018-14646
Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 SP2 Description A reflected XSS issue exists due to the "ftype" parameter in the "/member/myfriend.php" API endpoint. Recommendations For DedeCMS version 5.7 SP2, consider restricting access to the "/member/myfriend.php"...
PT-2018-14645
Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 SP2 Description The issue allows for XSS attacks via the "/member/uploads select.php" endpoint for the keyword parameter. Recommendations For DedeCMS version 5.7 SP2, as a temporary workaround, consider restricting access t...
PT-2018-14590
Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A CSRF issue allows changing the super administrator's username via the "index.php?m=member&f=index&v=edit&uid=1" endpoint, specifically targeting the uid variable set to 1, which corresponds to the super...
s-cms SQL Injection Vulnerability
s-cms is a content management system CMS based on PHP and MySQL. A SQL injection vulnerability exists in s-cms 3.0. A remote attacker can exploit the vulnerability by providing the '0id' parameter to the member/post.php file or POST data to the member/memberlogin.php file to log into the system...
DedeCMS Cross-Site Scripting Vulnerability (CNVD-2018-21795)
DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the /member/pm.php page in DedeCMS version 5.7 SP2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of the 'folder' parameter...
Cross site scripting
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter...
CVE-2018-18579
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter...
CVE-2018-18579: Improper Neutralization of Input During Web Page Generation
Reflected XSS exists in DedeCMS 5.7 SP2 via the /member/pm.php folder parameter...
PT-2018-14525
Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7 SP2 Description A reflected XSS issue exists, allowing potential exploitation via the "folder" parameter in the /member/pm.php endpoint. Recommendations For DedeCMS version 5.7 SP2, update to a newer version that contains a...
CVE-2015-4630
Multiple cross-site request forgery CSRF vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to 1 hijack the authentication of administrators for requests that create a user via a request to...
CVE-2015-4630: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to 1 hijack the authentication of administrators for requests that create a user via a request to...
PT-2018-4381
Name of the Vulnerable Software and Affected Versions Koha versions 3.14.x through 3.14.15 Koha versions 3.16.x through 3.16.11 Koha versions 3.18.x through 3.18.07 Koha versions 3.20.x through 3.20.0 Description The issue allows remote attackers to hijack the authentication of administrators for...
CVE-2018-18427
s-cms 3.0 allows SQL Injection via the member/post.php 0id parameter or the POST data to member/memberlogin.php...