CVE-2018-6893

controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering...

CVE-2018-6893: Improper Neutralization of Special Elements used in an SQL Command

controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module' with a SQL statement, lacks effective filtering...

PT-2018-17808

Name of the Vulnerable Software and Affected Versions FineCms version 5.2.0 Description The issue concerns SQL Injection in the FineCms software. Specifically, the "controllers/member/Api.php" file is affected when a request is made with certain parameters, including 's=member,c=api,m=checktitle'...

CentOS Web Panel Cross-Site Scripting Vulnerability (CNVD-2018-03251)

CentOS Web Panel is a CentOS Lnuix system administration panel. A cross-site scripting vulnerability exists in CentOS Web Panel 0.9.8.12 and earlier versions. A remote attacker can exploit this vulnerability by injecting script code into a client browser via the 'module' value of the index.php fi...

PT-2018-17249 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel versions through v0.9.8.12 Description: The issue concerns an XSS vulnerability via the module value of the "index.php" file. Recommendations: For versions through v0.9.8.12, as a temporary workaround, consider restricting...

CVE-2017-14983

Cross-site scripting XSS vulnerability in the EyesOfNetwork web interface aka eonweb 5.1-0 allows remote authenticated administrators to inject arbitrary web script or HTML via the object parameter to module/adminconf/index.php...

Code injection

EyesOfNetwork "EON" 5.0 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the selectedevents parameter in the 1 acknowledge, 2 delete, or 3 ownDisown function in module/monitoringged/gedfunctions.php or the 4 module parameter to module/index.php...

CVE-2016-4056

Cross-site scripting XSS vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module parameter when creating a bookmark...

Cross site scripting

Cross-site scripting XSS vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module parameter when creating a bookmark...

CVE-2016-4056

TYPO3 Backend component (TYPO3 6.2.x before 6.2.19) is affected by a Cross-site scripting (XSS) vulnerability. An attacker can inject arbitrary script/HTML via the module parameter when creating a bookmark, enabling script execution in an authenticated user’s browser. The issue stems from insuffi...

CVE-2016-4056: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module parameter when creating a bookmark...

PT-2017-8453

Name of the Vulnerable Software and Affected Versions TYPO3 versions 6.2.x through 6.2.18 Description A cross-site scripting XSS issue exists in the Backend component, allowing remote attackers to inject arbitrary web script or HTML via the module parameter when creating a bookmark. Recommendatio...

CVE-2012-1669: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in index.php in phpMoneyBooks before 1.0.3 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the module parameter...

PT-2014-4880

Name of the Vulnerable Software and Affected Versions VideoWhisper Webcam plugins for Drupal versions 7.x Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur...

kernel: block: passing disk names as format strings

Format string vulnerability in the registerdisk function in block/genhd.c in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers to /sys/module/mdmod/parameters/newarray in order to create a crafted /dev/md device nam...

CVE-2013-4880

Cross-site scripting XSS vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter...

PT-2013-5257

Name of the Vulnerable Software and Affected Versions BigTree CMS versions 4.0 RC2 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the module parameter in the /core/admin/modules/developer/modules/views/add.php endpoint...

CVE-2013-4880: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in core/admin/modules/developer/modules/views/add.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to inject arbitrary web script or HTML via the module parameter...

PT-2012-6188

Name of the Vulnerable Software and Affected Versions TomatoCart version 1.2.0 Alpha 2 and possibly earlier Description The issue allows remote attackers to read arbitrary files due to a directory traversal vulnerability in the json.php file. This is achieved by using a .. dot dot in the module...

Directory traversal

Directory traversal vulnerability in modules/comvtigerworkflow/sortfieldsjson.php in vtiger CRM 5.1.0 allows remote attackers to read arbitrary files via a .. dot dot in the modulename parameter...