187 matches found
Design/Logic Flaw
The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter...
CVE-2016-10994
The CVE-2016-10994 entry concerns the Truemag theme (WordPress) 2016 Q2 and reports an XSS vulnerability via the s parameter. Multiple connected sources corroborate an unauthenticated reflected XSS affecting the Truemag WordPress theme, with PoC examples showing input like s="> that can be ref...
CVE-2016-10994
The Truemag theme 2016 Q2 for WordPress has XSS via the s parameter...
CVE-2016-10993
The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter...
CVE-2016-10993
The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter...
Design/Logic Flaw
The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter...
CVE-2016-10993
The ScoreMe theme through 2016-04-01 for WordPress has XSS via the s parameter...
CVE-2017-18599
The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter...
Design/Logic Flaw
The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter...
CVE-2017-18599
The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter...
bluestarcooking.com XSS vulnerability
Open Bug Bounty ID: OBB-672223 Description| Value ---|--- Affected Website:| bluestarcooking.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
DamiCMS Directory Traversal Vulnerability
DamiCMS is a content management system CMS for building websites quickly. A directory traversal vulnerability exists in the admin.php file in DamiCMS version 6.0.1, which can be exploited to read the contents of the file with the help of the '|' character in the 's' parameter...
CVE-2018-16237
An issue was discovered in damiCMS V6.0.1. There is Directory Traversal via '|' characters in the s parameter to admin.php, as demonstrated by an admin.php?s=Tpl/Add/id/c:|windows|win.ini URI...
LFCMS Cross-Site Request Forgery Vulnerability
LFCMS is a PHP based on THINKPHP3.2.3 framework development, suitable for all kinds of video, film and television websites, film and television content management program. LFCMS 3.7.0 admin.php cross-site request forgery vulnerability exists. Remote attackers can use this vulnerability to hijack...
CVE-2018-12603
Cross-site request forgery CSRF vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecified users for requests that add administrator users via the s parameter, a related issue to CVE-2018-12114...
CVE-2018-11568
Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter. In some but not all cases, the '' characters have and representations...
CVE-2018-10225
thinkphp 3.1.3 has SQL Injection via the index.php s parameter...
Schneider Electric U.motion Builder Directory Traversal Vulnerability
U.motion Builder is a generator product from Schneider Electric France. A directory traversal vulnerability exists in Schneider Electric U.motion Builder when handling the 's' parameter of an applet. The vulnerability exists in the runscript.php applet and can be exploited to obtain sensitive...
Techno - Portfolio Management Panel SQL Injection Vulnerability
Techno - Portfolio Management Panel is a set of portfolio management panel scripts. A SQL injection vulnerability exists in Techno - Portfolio Management Panel 2017-11-16 and earlier versions. A remote attacker can exploit the vulnerability by sending the 's' parameter to the panel/search.php fil...