CVE-2020-18646

Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information via the component "/public/index.php"...

CVE-2020-18646: Exposure of Resource to Wrong Sphere

Information Disclosure in NoneCMS v1.3 allows remote attackers to obtain sensitive information via the component "/public/index.php"...

CVE-2020-23376: Cross-Site Request Forgery (CSRF)

NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parameter to launch a stored XSS attack...

CVE-2019-17431

An issue was discovered in fastadmin 1.0.0.20190705beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerability...

CVE-2019-17431: Cross-Site Request Forgery (CSRF)

An issue was discovered in fastadmin 1.0.0.20190705beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerability...

CVE-2019-16721: Cross-Site Request Forgery (CSRF)

NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user...

CVE-2018-18317: Cross-Site Request Forgery (CSRF)

DESHANG DSCMS 1.1 has CSRF via the public/index.php/admin/admin/add.html URI...

CVE-2018-9307

dsmall v20180320 allows XSS via the pdrsn parameter to public/index.php/home/predeposit/index.html...

CVE-2018-9307

dsmall v20180320 allows XSS via the pdrsn parameter to public/index.php/home/predeposit/index.html...

CVE-2018-9307: Improper Neutralization of Input During Web Page Generation

dsmall v20180320 allows XSS via the pdrsn parameter to public/index.php/home/predeposit/index.html...

CVE-2018-9016

dsmall v20180320 allows XSS via the main page search box at the public/index.php/home URI...

Cross site request forgery (csrf)

dsmall v20180320 allows physical path leakage via a public/index.php/home/predeposit/index.html?pdrsn= request...

CVE-2018-9016

dsmall v20180320 allows XSS via the main page search box at the public/index.php/home URI...

CVE-2018-9016

The CVE-2018-9016 entry corresponds to a cross‑site scripting (XSS) vulnerability in dsmall v20180320, exploitable via the main page search box (public/index.php/home). The CNVD entry explicitly notes that a remote attacker can inject arbitrary HTML/JavaScript to obtain sensitive information. The...

CVE-2018-9016: Improper Neutralization of Input During Web Page Generation

dsmall v20180320 allows XSS via the main page search box at the public/index.php/home URI...

CVE-2018-9017: Improper Neutralization of Input During Web Page Generation

dsmall v20180320 allows XSS via the member search box at the public/index.php/home/membersnsfriend/findlist.html URI...

CVE-2018-9014: Exposure of Sensitive Information to an Unauthorized Actor

dsmall v20180320 allows physical path leakage via a public/index.php/home/predeposit/index.html?pdrsn= request...

CVE-2018-9015: Improper Neutralization of Input During Web Page Generation

dsmall v20180320 allows XSS via the public/index.php/home/predeposit/index.html pdrsn parameter aka the CMS search box...

Code injection

dsmall v20180320 has XSS via a crafted street address to public/index.php/home/memberaddress/index.html, which is mishandled at public/index.php/home/memberaddress/edit/addressid/2.html...

CVE-2018-8906: Improper Neutralization of Input During Web Page Generation

dsmall v20180320 has XSS via a crafted street address to public/index.php/home/memberaddress/index.html, which is mishandled at public/index.php/home/memberaddress/edit/addressid/2.html...