CVE-2018-18427

CVE-2018-18427 affects s-cms 3.0. The vulnerability is a SQL injection in the web app, exploitable via the parameter 0_id in member/post.php or via POST data to member/member_login.php. The issue is triggered by unsafely handled input, enabling an attacker to manipulate SQL queries. The CVE entry...

PT-2018-14454

Name of the Vulnerable Software and Affected Versions s-cms version 3.0 Description The issue allows for SQL Injection, which can be exploited via the "0 id" parameter in the "member/post.php" endpoint or through the POST data sent to the "member/member login.php" endpoint. Recommendations For...

CVE-2018-18427: Improper Neutralization of Special Elements used in an SQL Command

s-cms 3.0 allows SQL Injection via the member/post.php 0id parameter or the POST data to member/memberlogin.php...

qibosoft Cross-Site Request Forgery Vulnerability

qibosoft is a content management system of China Qibo Software qibosoft Company. A cross-site request forgery vulnerability exists in qibosoft version 7.0. A remote attacker can add a user account using admin/index.php?lfj=member&action=addmember to exploit this vulnerability...

CVE-2018-18201

qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field...

CVE-2018-17866

Multiple cross-site scripting XSS vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field...

CVE-2018-17866

Multiple cross-site scripting XSS vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field...

CVE-2018-17866

Multiple cross-site scripting XSS vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field...

CVE-2018-17866

CVE-2018-17866 affects the WordPress plugin Ultimate Member – User Profile & Membership (vendor/product: Ultimate Member, affected version

CVE-2018-17866

Multiple cross-site scripting XSS vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field...

CVE-2018-18191

Cross-site request forgery CSRF vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password...

CVE-2018-18191

CVE-2018-18191 describes a Cross‑Site Request Forgery (CSRF) vulnerability in Dayrui FineCms 5.4, specifically in /admin.php?c=member&m=edit&uid=1, which allows remote attackers to change the administrator’s password. The connected documents confirm the affected product/version and the vulnerable...

PT-2018-14363

Name of the Vulnerable Software and Affected Versions qibosoft version 7.0 Description The issue allows for a CSRF attack, enabling an attacker to add a user account. This can be achieved through the "admin/index.php?lfj=member&action=addmember" API endpoint. Recommendations For qibosoft version...

PT-2018-14233

Name of the Vulnerable Software and Affected Versions Ultimate Member - User Profile & Membership plugin versions prior to 2.0.28 Description The issue allows remote attackers to inject arbitrary web script or HTML via the Primary button Text or Second button text field, potentially leading to...

CVE-2018-17866: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in includes/core/um-actions-login.php in the "Ultimate Member - User Profile & Membership" plugin before 2.0.28 for WordPress allow remote attackers to inject arbitrary web script or HTML via the "Primary button Text" or "Second button text" field...

CVE-2018-18191: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password...

PT-2018-14353

Name of the Vulnerable Software and Affected Versions FineCms version 5.4 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to modify the administrator's password through the "/admin.php?c=member&m=edit&uid=1" endpoint. Recommendations For FineCms version 5.4, ...

CVE-2016-7475

Under some circumstances on BIG-IP 12.0.0-12.1.0, 11.6.0-11.6.1, or 11.4.0-11.5.4 HF1, the Traffic Management Microkernel TMM may not properly clean-up pool member network connections when using SPDY or HTTP/2 virtual server profiles...

Ultimate Member < 2.0.28 - Multiple XSS

The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by a Multiple XSS security vulnerability...