CVE-2019-12922

A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page...

CVE-2019-12922: Cross-Site Request Forgery (CSRF)

A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page...

CVE-2019-14750

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...

PT-2019-3742

Name of the Vulnerable Software and Affected Versions phpMyAdmin version 4.9.0.1 Description The issue is related to a CSRF problem that can be exploited by a remote attacker to delete any server on the Setup page. This allows for unauthorized actions on the database management system...

WordPress plugin "spam-byebye" vulnerable to cross-site scripting

Overview The WordPress plugin "spam-byebye" contains a reflected cross-site scripting vulnerability CWE-79 qw3rTyTy reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary script may be executed on the...

PT-2018-12784

Name of the Vulnerable Software and Affected Versions EPSON WF-2750 version JP02I2 Description The Web interface AirPrint Setup page is susceptible to HTML Injection, which can redirect users to malicious sites. Recommendations For EPSON WF-2750 version JP02I2, consider disabling the AirPrint Set...

CVE-2018-14899: Improper Neutralization of Input During Web Page Generation

On the EPSON WF-2750 printer with firmware JP02I2, the Web interface AirPrint Setup page is vulnerable to HTML Injection that can redirect users to malicious sites...

Code injection

htdocs/setup/index.php in Eventum before 2.3.5 allows remote attackers to inject and execute arbitrary PHP code via the hostname parameter...

CVE-2014-1631

Eventum before 2.3.5 allows remote attackers to reinstall the application via direct request to /setup/index.php...

Cross site scripting

In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the databasetype parameter...

CVE-2017-9068

In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the databasetype parameter...

CVE-2017-9068

In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the databasetype parameter...

CVE-2017-9068

In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the databasetype parameter...

CVE-2017-9068

MODX Revolution prior to 2.5.7 contains a Reflected XSS vulnerability. An attacker can trigger XSS by injecting payloads into several fields on the setup page, demonstrated via the database_type parameter. Affected product: MODX Revolution. Root cause: input supplied on the setup page is reflecte...

CVE-2017-9068

In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the databasetype parameter...

CVE-2017-9068: Improper Neutralization of Input During Web Page Generation

In MODX Revolution before 2.5.7, an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page, as demonstrated by the databasetype parameter...

PT-2017-18684

Name of the Vulnerable Software and Affected Versions MODX Revolution versions prior to 2.5.7 Description The issue allows an attacker to trigger Reflected XSS by injecting payloads into several fields on the setup page, such as the database type parameter. Recommendations For MODX Revolution...

Arbitrary code execution vulnerability in Shield Spirit public number promotion system setup.php page

Shield Spirit Public Promotion System is a product that is mainly applied to public promotion alliance. An arbitrary code execution vulnerability exists in the setup.php page of the Shield Spirit Public Promotion System. Allow attackers to exploit the vulnerability to directly execute code...

Phillipine Long Distance Telephone SpeedSurf 504AN and Kasda KW58293 Cross-Site Request Forgery Vulnerability

The Phillipine Long Distance Telephone PLDT SpeedSurf 504AN and the Kasda KW58293 are modem and router all-in-one units. The PLDT SpeedSurf 504AN and Kasda KW58293 form2WlanSetup.cgi page fails to perform authentication correctly, allowing a remote attacker to construct a malicious URI, which...

Phillipine Long Distance Telephone SpeedSurf 504AN and Kasda KW58293 Cross-Site Scripting Vulnerabilities

The Phillipine Long Distance Telephone PLDT SpeedSurf 504AN and the Kasda KW58293 are modem and router all-in-one units. The PLDT SpeedSurf 504AN and Kasda KW58293 form2WlanSetup.cgi page fails to adequately filter the 'ssid' parameter, allowing a remote attacker to exploit the vulnerability by...