CVE-2026-51564

CVE-2026-51564 Aviso de seguridad para CVE-2026-51564 Descripción Un problema en el parámetro redirect en Milk admin =0.9.8 permite a atacantes remotos redirigir a los usuarios a URLs externas arbitrarias mediante una solicitud manipulada. Componentes afectados: App/Route.php, publichtml/index.ph...

EUVD-2019-16271

Malware in sbrugna...

PT-2023-12442 · WordPress · Ulisting

Name of the Vulnerable Software and Affected Versions: uListing plugin for WordPress versions up to, and including, 1.6.6 Description: The issue is related to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file. This affects the...

Cross site request forgery (csrf)

Cross Site Request Forgery CSRF vulnerability exist in PopojiCMS 2.0.1 in po-admin/route.php?mod=user&act=multidelete...

CVE-2021-28070

Cross Site Request Forgery CSRF vulnerability exist in PopojiCMS 2.0.1 in po-admin/route.php?mod=user&act=multidelete...

CVE-2021-28070

CVE-2021-28070 describes a Cross-Site Request Forgery (CSRF) vulnerability in PopojiCMS 2.0.1, specifically in po-admin/route.php?mod=user&act=multidelete. The connected Red Hat, CNVD, CNVD-like and other listings confirm the same issue but do not provide concrete exploit details in these documen...

PT-2021-17734

Name of the Vulnerable Software and Affected Versions: PopojiCMS version 2.0.1 Description: A Cross Site Request Forgery CSRF issue exists, which can be exploited through the /po-admin/route.php?mod=user&act=multidelete API endpoint. This allows for potentially unauthorized actions on user...

CVE-2021-28070: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability exist in PopojiCMS 2.0.1 in po-admin/route.php?mod=user&act=multidelete...

CVE-2019-18816

po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post1content= stored XSS...

PT-2019-15676

Name of the Vulnerable Software and Affected Versions PopojiCMS version 2.0.1 Description The issue concerns a stored XSS vulnerability. It is related to the po-admin/route.php?mod=post&act=edit endpoint, where the post1content parameter is vulnerable. Recommendations For PopojiCMS version 2.0.1,...

CVE-2019-18816: Improper Neutralization of Input During Web Page Generation

po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post1content= stored XSS...

CVE-2019-9549

An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=user&act=addnew URI, as demonstrated by adding a level=1 account, a similar issue to CVE-2018-18935...

CVE-2019-9549

An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=user&act=addnew URI, as demonstrated by adding a level=1 account, a similar issue to CVE-2018-18935...

PT-2019-19700

Name of the Vulnerable Software and Affected Versions PopojiCMS version 2.0.1 Description An issue was discovered in PopojiCMS, allowing CSRF via the "po-admin/route.php?mod=user&act=addnew" URI. This can be exploited to add a level=1 account. Recommendations For PopojiCMS version 2.0.1, as a...

CVE-2019-9549: Cross-Site Request Forgery (CSRF)

An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=user&act=addnew URI, as demonstrated by adding a level=1 account, a similar issue to CVE-2018-18935...

CVE-2019-7580

ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admincategory/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection...

CVE-2019-7580

ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admincategory/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection...

PT-2019-18655

Name of the Vulnerable Software and Affected Versions ThinkCMF version 5.0.190111 Description The issue allows remote attackers to execute arbitrary PHP code. This is due to the mishandling of a single quote character, which enables data/conf/route.php injection via the "alias" parameter in the...

CVE-2019-7580: Improper Control of Generation of Code

ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admincategory/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection...

CVE-2019-6713

app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving portal/List/index and list/:id to inject this code into data\conf\route.php, as demonstrated by a fileputcontents call...