4667 matches found
PT-2018-9819 · Wuzhi · Wuzhi Cms
Name of the Vulnerable Software and Affected Versions: WUZHI CMS version 4.1.0 Description: The issue allows for a CSRF attack to change the password of a common member. This is possible through the "index.php?m=member&v=pw reset" endpoint, which is vulnerable to such attacks. Recommendations: Fo...
WUZHI CMS Cross-Site Request Forgery Vulnerability (CNVD-2018-08547)
WUZHI CMS is China's five fingers WUZHI Internet technology company based on PHP and MySQL open source content management system CMS. A cross-site request forgery vulnerability exists in index.php?m=member&v=pwreset in WUZHI CMS version 4.1.0. A remote attacker can exploit the vulnerability to...
lastore-daemon D-Bus Privilege Escalation
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'lastore-daemon D-Bus Privilege Escalation', 'Description' = %q This module attempts to gain root privileges on Deepin Linux systems by using...
CVE-2018-10235
POSCMS 3.2.10 allows remote attackers to execute arbitrary PHP code via the diy\module\member\controllers\admin\Setting.php 'index' function because an attacker can control the value of $cache'setting''ucssocfg' in diy\module\member\models\Membermodel.php and write this code into the...
Code injection
POSCMS 3.2.10 allows remote attackers to execute arbitrary PHP code via the diy\module\member\controllers\admin\Setting.php 'index' function because an attacker can control the value of $cache'setting''ucssocfg' in diy\module\member\models\Membermodel.php and write this code into the...
CVE-2018-10235
POSCMS 3.2.10 allows remote attackers to execute arbitrary PHP code via the diy\module\member\controllers\admin\Setting.php 'index' function because an attacker can control the value of $cache'setting''ucssocfg' in diy\module\member\models\Membermodel.php and write this code into the...
CVE-2018-10219
baijiacms V3 has physical path leakage via an index.php?mod=mobile&name=member&do=index request...
CVE-2018-10219
CVE-2018-10219 affects baijiacms V3 and describes a physical path leakage exploitation via the request index.php?mod=mobile&name=member&do=index. Public sources (CNVD-2018-11709, NVD entry) attribute an information disclosure vulnerability to this path leakage, with the impact on confidentiality ...
CVE-2018-10235: Improper Control of Generation of Code
POSCMS 3.2.10 allows remote attackers to execute arbitrary PHP code via the diy\module\member\controllers\admin\Setting.php 'index' function because an attacker can control the value of $cache'setting''ucssocfg' in diy\module\member\models\Membermodel.php and write this code into the...
CVE-2018-9927
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a user account via index.php?m=member&f=index&v=add...
PT-2018-19095
Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A CSRF issue was discovered, allowing an attacker to add a user account via the "index.php?m=member&f=index&v=add" endpoint. Recommendations For WUZHI CMS version 4.1.0, consider implementing proper CSRF...
CVE-2018-9927: Cross-Site Request Forgery (CSRF)
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a user account via index.php?m=member&f=index&v=add...
DedeCMS system has arbitrary file deletion vulnerability
Weaving dream content management system DedeCms is a PHP open source website management system. An arbitrary file deletion vulnerability exists in the DedeCMS system\member\editface.php file. An attacker can exploit the vulnerability to delete arbitrary files...
dsmall cross-site scripting vulnerability (CNVD-2018-07558)
dsmall is a multi-user platform-level online shopping mall system. A cross-site scripting vulnerability exists in dsmall version 20180320. A remote attacker can inject arbitrary HTML/JavaScript code to obtain sensitive information via the member query box in the...
CVE-2018-9017
dsmall v20180320 allows XSS via the member search box at the public/index.php/home/membersnsfriend/findlist.html URI...
Code injection
dsmall v20180320 allows XSS via the member search box at the public/index.php/home/membersnsfriend/findlist.html URI...
CVE-2018-9017
dsmall v20180320 allows XSS via the member search box at the public/index.php/home/membersnsfriend/findlist.html URI...
CVE-2018-9017
dsmall v20180320 allows XSS via the member search box at the public/index.php/home/membersnsfriend/findlist.html URI...
CVE-2018-9017
CVE-2018-9017 affects dsmall v20180320 with a cross-site scripting (XSS) vulnerability可 in the public/index.php/home/membersnsfriend/findlist.html page via the member search box. CNVD/CNVD-2018-07558 describe a remote attacker injecting HTML/JavaScript to obtain sensitive information. The provide...