Stored Cross-Site Scripting Vulnerability in JEECMS Version 9.3

JEECMS is Jiangxi Jinlei Technology Development Co., Ltd. developed a support for WeChat small program, WeChat public number / service number, column model, content model cross-customization, as well as with the payment and financial settlement of the content of the e-commerce as one of the conte...

CVE-2018-16448

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

CVE-2018-16448

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

Cross site request forgery (csrf)

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

CVE-2018-16448

Cscms 4 allows CSRF for creating a member via upload/admin.php/user/save, authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid, and creating a super administrator and web editor via upload/admin.php/sys/save...

CVE-2018-16448

CVE-2018-16448 affects Cscms 4. It documents CSRF in admin endpoints: creating a member via upload/admin.php/user/save; authenticating vip members via upload/admin.php/user/init/tid and upload/admin.php/user/init/rzid; and creating a super administrator and web editor via upload/admin.php/sys/sav...

Sql injection

phpkaiyuancms PhpOpenSourceCMS POSCMS V3.2.0 allows an unauthenticated user to execute arbitrary SQL commands via the diy/module/member/controllers/Api.php ajaxsavedraft function with the dir parameter...

WordPress Ultimate Member plugin <= 2.0.21 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found in WordPress Ultimate Member plugin versions = 2.0.21. Solution Update the WordPress Ultimate Member plugin to the latest available version at least 2.0.22...

PT-2018-13272

Name of the Vulnerable Software and Affected Versions ASPCMS version 2.5.6 Description An issue was discovered in the addUser function of the "/member/reg.asp" page, allowing ordinary users to be registered with the super administrators GroupID directly. Recommendations For ASPCMS version 2.5.6,...

Microsoft Windows: Audit Application Group Management

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winapplicationgroupmanagement.nasl 11068 2018-08-21 11:51:41Z emoss $ Check value for Audit Application Group Management Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This...

Ultimate Member < 2.0.22 - Authenticated Cross-Site Scripting (XSS)

The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

WordPress Ultimate Member plugin <= 2.0.21 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability found in WordPress Ultimate Member plugin versions = 2.0.21. Solution Update the WordPress Ultimate Member plugin to the latest available version at least 2.0.22...

Ultimate Member < 2.0.22 - Unauthenticated Arbitrary File Upload

The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by an Unauthenticated Arbitrary File Upload security vulnerability...

Unrestricted file upload

A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business basic version V1.11 allows any remote member to upload a .php file to the web server via a profile avatar field, by using an image Content-Type e.g., image/jpeg with a modified filename and file...

CVE-2018-14570

A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business basic version V1.11 allows any remote member to upload a .php file to the web server via a profile avatar field, by using an image Content-Type e.g., image/jpeg with a modified filename and file...

CVE-2018-14570: Unrestricted Upload of File with Dangerous Type

A file upload vulnerability in application/shop/controller/member.php in Niushop B2B2C Multi-business basic version V1.11 allows any remote member to upload a .php file to the web server via a profile avatar field, by using an image Content-Type e.g., image/jpeg with a modified filename and file...

Design/Logic Flaw

libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php.jpg URI in the SRC attribute of an IMG element within infocontent JSON data to the index.php?m=member&c=index&a=register URI...

mahircopywriting.com XSS vulnerability

Open Bug Bounty ID: OBB-648554 Description| Value ---|--- Affected Website:| mahircopywriting.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

roa.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-648553 Description| Value ---|--- Affected Website:| roa.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ciht.org.uk XSS vulnerability

Open Bug Bounty ID: OBB-648549 Description| Value ---|--- Affected Website:| ciht.org.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...