PT-2020-12066 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue concerns the handling of URIs in admin/header.php, which allows for Reflected XSS attacks. This can be exploited in admin/add-language.php by adding a question mark ?...

PT-2020-12060 · Wkhtmltopdf +1 · Wkhtmltopdf +1

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue allows remote attackers to achieve code execution by saving the code to be executed as the wkhtmltopdf path via the admin/save-settings.php endpoint. This is made possible...

PT-2020-12121 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue concerns the handling of URIs in admin/header.php, which allows for Reflected XSS attacks. This can be exploited in admin/report-user.php by adding a question mark ? follow...

PT-2020-12117 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue concerns the handling of URIs in admin/header.php, which allows for Reflected XSS attacks. This can be exploited by injecting arbitrary web script or HTML in...

PT-2020-12171 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue allows attackers to edit a department, given the id, via a crafted request to the "admin/manage-departments.php" endpoint. This is made possible by a CSRF weakness...

CVE-2020-10387: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files from the server using a dot-dot-slash sequence ../ via the GET parameter file...

CVE-2020-10431: Improper Neutralization of Input During Web Page Generation

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-templates.php by adding a question mark ? followed by the payload...

CVE-2020-10417: Improper Neutralization of Input During Web Page Generation

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-articles.php by adding a question mark ? followed by the payload...

CVE-2020-10412: Improper Neutralization of Input During Web Page Generation

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/import-csv.php by adding a question mark ? followed by the payload...

CVE-2020-10405: Improper Neutralization of Input During Web Page Generation

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/edit-glossary.php by adding a question mark ? followed by the payload...

CVE-2020-10396: Improper Neutralization of Input During Web Page Generation

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/add-language.php by adding a question mark ? followed by the payload...

CVE-2020-10394: Improper Neutralization of Input During Web Page Generation

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/add-glossary.php by adding a question mark ? followed by the payload...

CVE-2020-10390: Improper Neutralization of Special Elements used in an OS Command

OS Command Injection in export.php vulnerable function called from include/functions-article.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by saving the code to be executed as the wkhtmltopdf path via admin/save-settings.php...

CVE-2020-10426: Improper Neutralization of Input During Web Page Generation

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-groups.php by adding a question mark ? followed by the payload...

CVE-2020-10487: Cross-Site Request Forgery (CSRF)

CSRF in admin/manage-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to delete a glossary term via a crafted request...

CVE-2020-10484: Cross-Site Request Forgery (CSRF)

CSRF in admin/add-field.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to create a custom field via a crafted request...

CVE-2020-10483: Cross-Site Request Forgery (CSRF)

CSRF in admin/ajax-hub.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to post a comment on any article via a crafted request...

CVE-2020-10478: Cross-Site Request Forgery (CSRF)

CSRF in admin/manage-settings.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to change the global settings, potentially gaining code execution or causing a denial of service, via a crafted request...

CVE-2020-10468: Improper Neutralization of Input During Web Page Generation

Reflected XSS in admin/edit-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p...

CVE-2020-10461: Improper Neutralization of Input During Web Page Generation

The way comments in article.php vulnerable function in include/functions-article.php are handled in Chadha PHPKB Standard Multi-Language 9 allows attackers to execute Stored Blind XSS injecting arbitrary web script or HTML in admin/manage-comments.php, via the GET parameter cmt...