372 matches found
SeedDMS < 5.1.11 - 'out.GroupMgr.php' Cross-Site Scripting
Exploit Title: Persistent Cross-Site Scripting or Stored XSS in out/out.GroupMgr.php in SeedDMS before 5.1.11 Google Dork: NA Date: 17-June-2019 Exploit Author: Nimit Jainhttps://secfolks.blogspot.com Vendor Homepage: https://www.seeddms.org Software Link:...
CVE-2019-12745
out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting XSS via the name field...
CVE-2019-12744
SeedDMS before 5.1.11 allows Remote Command Execution RCE because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940...
CVE-2019-12744
SeedDMS before 5.1.11 allows Remote Command Execution RCE because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940...
CVE-2019-12745
out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting XSS via the name field...
Design/Logic Flaw
SeedDMS before 5.1.11 allows Remote Command Execution RCE because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940...
Cross site scripting
out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting XSS via the name field...
CVE-2019-12745
out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting XSS via the name field...
CVE-2019-12745
SeedDMS contains a Stored XSS vulnerability in out/out.UsrMgr.php exploited via the name field, affecting versions before 5.1.11. The issue is documented across multiple sources (CVE-2019-12745, Red Hat advisory, Exploit-DB records) and involves injecting script code in user-name handling during ...
CVE-2019-12744
SeedDMS prior to 5.1.11 is affected by CVE-2019-12744 due to an unvalidated file upload of PHP scripts, enabling Remote Command Execution over the network. The root cause is the upload of PHP-backdoor-like content into documents, allowing execution of arbitrary commands on the server when the upl...
CVE-2019-12744
SeedDMS before 5.1.11 allows Remote Command Execution RCE because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940...
PT-2019-12914
Name of the Vulnerable Software and Affected Versions SeedDMS versions prior to 5.1.11 Description The issue allows for Remote Command Execution RCE due to unvalidated file upload of PHP scripts. Recommendations For versions prior to 5.1.11, update to version 5.1.11 or later to resolve the issue...
PT-2019-12915
Name of the Vulnerable Software and Affected Versions SeedDMS versions prior to 5.1.11 Description The issue allows for Stored Cross-Site Scripting XSS via the name field in the out/out.UsrMgr.php file. Recommendations For versions prior to 5.1.11, update to version 5.1.11 or later to resolve the...
CVE-2019-12745: Improper Neutralization of Input During Web Page Generation
out/out.UsrMgr.php in SeedDMS before 5.1.11 allows Stored Cross-Site Scripting XSS via the name field...
CVE-2019-12744: Unrestricted Upload of File with Dangerous Type
SeedDMS before 5.1.11 allows Remote Command Execution RCE because of unvalidated file upload of PHP scripts, a different vulnerability than CVE-2018-12940...
SeedDMS Cross-Site Scripting Vulnerability (CNVD-2019-18509)
SeedDMS is a free document management system with an easy-to-use web-based user interface. A stored cross-site scripting vulnerability exists in out/out.GroupMgr.php in SeedDMS 5.1.11. An attacker can exploit this vulnerability by creating a new group with a JavaScript payload as the group name t...
CVE-2019-12801
out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Name...
CVE-2019-12801
out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the "GROUP" Name...