CVE-2019-14789

The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter...

PT-2019-13834 · WordPress · Custom 404 Pro

Name of the Vulnerable Software and Affected Versions: Custom 404 Pro plugin version 3.2.8 Description: The issue concerns a problem with the Custom 404 Pro plugin for WordPress, where there is an XSS issue via the "page" parameter in the wp-admin/admin.php page. Recommendations: For Custom 404 P...

CVE-2018-19386

SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI...

PT-2019-9798

Name of the Vulnerable Software and Affected Versions SolarWinds Database Performance Analyzer version 11.1.457 Description The issue concerns a Reflected XSS in the idcStateError component. Specifically, the page parameter is reflected into the HREF of the 'Try Again' Button on the page, which c...

CVE-2018-19386: Improper Neutralization of Input During Web Page Generation

SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI...

PT-2019-8907

Name of the Vulnerable Software and Affected Versions Eventum version 3.5.0 Description An issue was discovered in the htdocs/switch.php file, where there is a cross-site scripting XSS vulnerability via the current page parameter. This allows for potential malicious script execution...

Elite Graphix Elite CMS Pro SQL Injection Vulnerability

Elite Graphix Elite CMS Pro is a lightweight PHP and MySQL based content management system from Elite Graphix India. A SQL injection vulnerability exists in the '?page=' parameter of the /admin/addsidebar.php file in Elite Graphix Elite CMS Pro version 2.01, which stems from a lack of validation ...

PT-2019-8880

Name of the Vulnerable Software and Affected Versions Elite CMS Pro version 2.01 Description An issue was discovered in the software, where the page parameter in the /admin/add sidebar.php API endpoint is vulnerable to SQL injection. Recommendations For Elite CMS Pro version 2.01, consider...

CVE-2018-12250: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Elite CMS Pro 2.01. In /admin/addsidebar.php, the ?page= parameter is vulnerable to SQL injection...

CVE-2019-7687

cgi-bin/qcmapwebcgi on JioFi 4 jmr1140 AmtelJMR1140R12.07 devices has POST based reflected XSS via the Page parameter. No sanitization is performed for user input data...

PT-2019-18703

Name of the Vulnerable Software and Affected Versions JioFi 4 jmr1140 Amtel JMR1140 R12.07 Description The issue concerns a reflected XSS vulnerability. It occurs via the Page parameter in the cgi-bin/qcmap web cgi endpoint. The problem arises because no sanitization is performed on user input...

CVE-2019-7687: Improper Neutralization of Input During Web Page Generation

cgi-bin/qcmapwebcgi on JioFi 4 jmr1140 AmtelJMR1140R12.07 devices has POST based reflected XSS via the Page parameter. No sanitization is performed for user input data...

CVE-2019-9593

A reflected Cross-site scripting XSS vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2019-9593: Improper Neutralization of Input During Web Page Generation

A reflected Cross-site scripting XSS vulnerability in ShoreTel Connect ONSITE 18.82.2000.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2019-9576

The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS...

CVE-2019-8363

Verydows 2.0 has XSS via the index.php?c=main a parameter, as demonstrated by an a=indexXSS value...

CVE-2018-19906

Stored XSS exists in razorCMS 3.4.8 via the //page description parameter...

CVE-2018-20557

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/page.php?rec=edit has XSS via the pagename parameter...

Pluck cross-site scripting vulnerability (CNVD-2018-25042)

Pluck is a simple content management system CMS written in PHP. A cross-site scripting vulnerability exists in Pluck version 4.7.7. A remote attacker can exploit this vulnerability by sending the 'title' field to the admin.php?action=editpage&page=14253123 URL to execute malicious script...

PT-2018-13660

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.7 Description The issue allows for XSS via the admin.php?action=editpage&page= endpoint, specifically the page parameter. This can be exploited by manipulating the page title. Recommendations For Pluck version 4.7.7, consider...