Cross site scripting

SeaCMS V6.61 has XSS via the site name parameter on an adm1n/adminconfig.php page aka a system management page...

CVE-2018-12431

SeaCMS V6.61 has XSS via the site name parameter on an adm1n/adminconfig.php page aka a system management page...

CVE-2018-12431

SeaCMS V6.61 is vulnerable to Cross‑Site Scripting via the site name parameter on adm1n/admin_config.php (system management page). The root cause is an XSS flaw in the site name input; impact is user‑visible script injection. The connected records confirm the vulnerability across multiple sources...

CVE-2018-12431: Improper Neutralization of Input During Web Page Generation

SeaCMS V6.61 has XSS via the site name parameter on an adm1n/adminconfig.php page aka a system management page...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15629)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the activatereplicaVTLcontainer method in Quest DR Series disk backup software before 4.0.3.1. An attacker could exploit this vulnerability to execute commands via the container name...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15627)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the "Start Copy" method in Quest DR Series Disk Backup Software before 4.0.3.1. The vulnerability can be exploited to execute arbitrary commands via the 'name' parameter...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15633)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the "Delete Storage Group" method in Quest DR Series Disk Backup Software before 4.0.3.1. The vulnerability can be exploited to execute system commands via the 'name' parameter...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15631)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the "Delete Diagnostics" method in Quest DR Series Disk Backup Software before 4.0.3.1. The vulnerability can be exploited to execute commands via the 'filename' parameter...

CVE-2018-11649

Hue 3.12 has XSS via the /pig/save/ name and script parameters...

CVE-2018-11649

Hue 3.12 has XSS via the /pig/save/ name and script parameters...

DomainMod cross-site scripting vulnerability (CNVD-2018-10863)

DomainMod is a PHP and MySQL based open source application for managing centrally located domain names and other Internet assets. A cross-site scripting vulnerability exists in DomainMod version 4.10.0. A remote attacker can exploit this vulnerability to execute JavaScript code with the help of t...

Moxa EDR-810 Command Injection Vulnerability (CNVD-2018-11721)

The EDR-810 is a highly integrated industrial multi-port security router with firewall/NAT/VPN and two-layer manageable switch functionality. A command injection vulnerability exists in the web server functionality of the Moxa EDR-810 V4.1 build 17030317. The vulnerability can be exploited to...

TP-Link EAP Controller and Omada Controller Cross-Site Scripting Vulnerability (CNVD-2018-09302)

TP-Link EAP Controller and Omada Controller are both software from China P&L TP-LINK for remote control of wireless AP access point devices. A cross-site scripting vulnerability exists in TP-Link EAP Controller and Omada Controller versions 2.5.4Windows and 2.6.0Windows. A remote attacker can...

Frog CMS Cross-Site Scripting Vulnerability (CNVD-2018-09306)

Frog CMS is a content management system CMS developed by software developer Philippe Archambault. The system provides tools for page templates, user rights management, and document management. A cross-site scripting vulnerability exists in Frog CMS version 0.9.5. A remote attacker can exploit thi...

CVE-2018-10680

Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings -- Basic setting -- Website title" and enters an XSS payload via the zbsystem/cmd.php ZCBLOGNAME parameter. NOTE: the vendor disputes the security relevance, noting ...

CVE-2018-10469

b3log Symphony aka Sym 2.6.0 allows remote attackers to upload and execute arbitrary JSP files via the name parameter to the /upload URI...

PT-2018-9888

Name of the Vulnerable Software and Affected Versions: b3log Symphony aka Sym version 2.6.0 Description: The issue allows remote attackers to upload and execute arbitrary JSP files. This is achieved via the name parameter to the "/upload" URI. Recommendations: For version 2.6.0, consider...

PT-2018-17606

Name of the Vulnerable Software and Affected Versions Composr CMS version 10.0.13 Description The issue concerns a security problem where an attacker can inject malicious code. This is achieved by manipulating the site name parameter in a specific request to the '/adminzone/index.php' API endpoin...

Frog CMS Cross-Site Scripting Vulnerability (CNVD-2018-08554)

Frog CMS is a content management system CMS developed by software developer Philippe Archambault. The system provides tools for page templates, user rights management, and document management. A cross-site scripting vulnerability exists in Frog CMS version 0.9.5. A remote attacker can exploit the...

Frog CMS Cross-Site Scripting Vulnerability (CNVD-2018-08555)

Frog CMS is a content management system CMS developed by software developer Philippe Archambault. The system provides tools for page templates, user rights management, and document management. A cross-site scripting vulnerability exists in Frog CMS version 0.9.5. A remote attacker can exploit the...