PT-2018-11741

Name of the Vulnerable Software and Affected Versions Buffalo TS5600D1206 version 3.61-0.10 Description The issue concerns system command injection in the User.create method, allowing attackers to execute system commands via the name parameter. Recommendations For Buffalo TS5600D1206 version...

CVE-2018-13318: Improper Neutralization of Special Elements used in an OS Command

System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the "name" parameter...

Ticketly 1.0 - name SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Ticketly 1.0 – 'name' SQL Injection Exploit Author: Javier Olmedo Website: https://hackpuntes.com Vendor: Abisoft https://abisoftgt.net Software Link: https://abisoftgt.net/software/6/sistema-de-tickets-y-soporte-con-php-y-mysql...

FruityWifi Code Execution Vulnerability

FruityWifi is a wireless network auditing tool. A security vulnerability exists in the www/modules/save.php file in FruityWifi 2.4 and earlier versions. A remote attacker can exploit this vulnerability by sending a specially crafted 'modname' parameter via a POST request to execute arbitrary code...

CVE-2018-19170

In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the webname parameter...

CVE-2018-19170

In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the webname parameter...

CVE-2018-19089

tianti 2.3 has stored XSS in the userlist module via the tianti-module-admin/user/ajax/saverole name parameter, which is mishandled in tianti-module-admin\src\main\webapp\WEB-INF\views\user\userlist.jsp...

PT-2018-14801

Name of the Vulnerable Software and Affected Versions tianti version 2.3 Description The issue concerns a stored XSS in the userlist module. This occurs via the name parameter in the "tianti-module-admin/user/ajax/save role" endpoint, which is mishandled in the...

CVE-2018-18868

No-CMS 1.1.3 is prone to Persistent XSS via a contactus name parameter, as demonstrated by the VG48Z5PqVWname parameter...

PT-2018-14702

Name of the Vulnerable Software and Affected Versions No-CMS version 1.1.3 Description The issue allows for Persistent XSS attacks through the name parameter in the contact us functionality. This is demonstrated by exploiting the name parameter, such as the VG48Z5PqVWname parameter. Recommendatio...

CVE-2018-18868: Improper Neutralization of Input During Web Page Generation

No-CMS 1.1.3 is prone to Persistent XSS via a contactus name parameter, as demonstrated by the VG48Z5PqVWname parameter...

Fiyo CMS Cross-Site Scripting Vulnerability (CNVD-2018-21626)

Fiyo CMS is a content management system CMS for creating CMS templates. A cross-site scripting vulnerability exists in the dapur\apps\appuser\edituser.php page in Fiyo CMS version 2.0.7. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the 'name'...

Design/Logic Flaw

Fiyo CMS 2.0.7 has XSS via the dapur\apps\appuser\edituser.php name parameter...

CVE-2018-18545

Fiyo CMS 2.0.7 has XSS via the dapur\apps\appuser\edituser.php name parameter...

CVE-2018-18545

Fiyo CMS 2.0.7 has XSS via the dapur\apps\appuser\edituser.php name parameter...

PT-2018-14505

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7 Description The issue is related to a security problem where an attacker can inject malicious code. The name parameter in the "dapurappsapp useredit user.php" endpoint is vulnerable. Recommendations For Fiyo CMS version...

CVE-2018-18545: Improper Neutralization of Input During Web Page Generation

Fiyo CMS 2.0.7 has XSS via the dapur\apps\appuser\edituser.php name parameter...

CVE-2018-18416

LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the sitename parameter to the admin/settings/update URI...

PT-2018-14448

Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM version 3.1 Description A Stored XSS issue has been found in the input and upload sections of the software. This is demonstrated by the name parameter to the "index.php/admin/client/create" URI. Recommendations For...

DESTOON B2B Cross-Site Scripting Vulnerability (CNVD-2018-21497)

DESTOON B2B is a PHP and MySQL based on open source B2B e-commerce website management system . A cross-site scripting vulnerability exists in the admin/category.inc.php file in DESTOON B2B version 7.0. A remote attacker can inject arbitrary Web script or HTML by providing the 'categorycatname'...