CVE-2018-8906

dsmall v20180320 has XSS via a crafted street address to public/index.php/home/memberaddress/index.html, which is mishandled at public/index.php/home/memberaddress/edit/addressid/2.html...

WebSphere Application Server Attribute In Use Exception

The vulnerability of the javax.naming.directory.AttributeInUseException class in the Virtual Member Manager component of the WebSphere Application Server server is related to errors that occur during password updates using the IBM Tivoli Directory Server. Exploiting this vulnerability can allow a...

YzmCMS Eval Injection Vulnerability

YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A security vulnerability exists in the yzmphp/core/function/global.func.php file in YzmCMS version 3.7.1. A remote attacker can exploit this vulnerability by executing arbitrary code with the PHP...

CVE-2018-8756

Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP code in the POST data of an index.php?m=member&c=membercontent&a=init request...

CVE-2018-8756

Eval injection in yzmphp/core/function/global.func.php in YzmCMS v3.7.1 allows remote attackers to achieve arbitrary code execution via PHP code in the POST data of an index.php?m=member&c=membercontent&a=init request...

PT-2018-18616

Name of the Vulnerable Software and Affected Versions YzmCMS version 3.7.1 Description The issue concerns an eval injection in a specific PHP file, allowing remote attackers to execute arbitrary code. This is achieved by sending PHP code in the POST data of a particular request to...

maisrh.net XSS vulnerability

Open Bug Bounty ID: OBB-576642 Description| Value ---|--- Affected Website:| maisrh.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

SQL Injection Vulnerability in BEESCMS Frontend member.php and order_save.php Pages

BEESCMS is an enterprise website management system based on PHP+Mysql architecture. A SQL injection vulnerability exists in the BEESCMS frontend member.php and ordersave.php pages. An attacker can exploit the vulnerability to obtain sensitive database information...

Injection Vulnerability in Guomicro CMS Government Website System v20180121 Member Registration

State Micro CMS is one of the mainstream CMS systems in China, and is also the largest open source platform provider in the field of PHP in Southern China. State Micro CMS government website system v20180121 injection vulnerability exists in the member registration , attackers can use the...

IBM WebSphere Application Server Virtual Member Manager Elevation of Privilege Vulnerability

IBM WebSphere Application Server WAS is an application server product developed and distributed by IBM in the U.S. It is a platform for Java EE and Web services applications and the foundation of the IBM WebSphere software platform.Virtual Member Manager is one of the virtual environment manageme...

WordPress Ultimate Member Plugin 2.0 Multiple XSS Vulnerabilities

The WordPress plugin Copyright C 2018 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

SQL Injection Vulnerability in ThinkLC V3.9 Classified Information System www_member_admin_money.php Page

ThinkLC Classified Information System is a local classified information system built on PHP+MYSQL development. SQL injection vulnerability exists in the wwwmemberadminmoney.php page of ThinkLC V3.9 Classified Information System, which can be exploited by attackers to obtain sensitive information...

Ultimate Member <= 2.0 - Multiple XSS

The Ultimate Member – User Profile, User Registration, Login & Membership Plugin WordPress plugin was affected by a Multiple XSS security vulnerability...

FineCms controllers/member/Api.php file SQL injection vulnerability

FineCms is a content management system CMS developed using MVC architecture and PDO database interface. A SQL injection vulnerability exists in the controllers/member/Api.php file in FineCms version 5.2.0, which stems from the program failing to perform effective filtering. A remote attacker can...

Sql injection

controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering...

CVE-2018-6893

controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering...

PT-2018-17808

Name of the Vulnerable Software and Affected Versions FineCms version 5.2.0 Description The issue concerns SQL Injection in the FineCms software. Specifically, the "controllers/member/Api.php" file is affected when a request is made with certain parameters, including 's=member,c=api,m=checktitle'...

CVE-2018-6893: Improper Neutralization of Special Elements used in an SQL Command

controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering...

apssonline.org XSS vulnerability

Open Bug Bounty ID: OBB-556121 Description| Value ---|--- Affected Website:| apssonline.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2011-4889

CVE-2011-4889 affects IBM WebSphere Application Server via the Virtual Member Manager. The root cause is aPassword update flaw in the Tivoli Directory Server configuration caused by the javax.naming.directory.AttributeInUseException, which might allow a remote attacker to gain access using an old...