getsimplecms 跨站脚本漏洞

GetSimple CMS is an XML-based, completely self-contained, streamlined content management system. A cross-site scripting vulnerability exists in GetSimple CMS 3.3.15 and earlier versions. The vulnerability can be exploited to conduct cross-site scripting attacks via the sitename, username, and ema...

CVE-2020-18659: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in GetSimpleCMS =3.3.15 via the 1 sitename, 2 username, and 3 email parameters to /admin/setup.php...

Cross site scripting

NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Setup.php tet parameter...

CVE-2020-15034

NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Setup.php tet parameter...

CVE-2020-15034

CVE-2020-15034 : NeDi 1.9C is vulnerable to cross-site scripting (XSS) via the Monitoring-Setup.php tet parameter, allowing an attacker to execute arbitrary JavaScript in a victim’s browser. The provided documents state the vulnerability but do not include remediation details or confirmed exploit...

PT-2020-14135

Name of the Vulnerable Software and Affected Versions NeDi version 1.9C Description The issue allows an attacker to execute arbitrary JavaScript code via the "Monitoring-Setup.php" tet parameter, enabling a cross-site scripting XSS attack. Recommendations For NeDi version 1.9C, as a temporary...

CVE-2020-15034: Improper Neutralization of Input During Web Page Generation

NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Setup.php tet parameter...

CVE-2020-12743

An issue was discovered in Gazie 7.32. A successful installation does not remove or block or in any other way prevent use of its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hiddenreq POST paramet...

CVE-2020-12743: Files or Directories Accessible to External Parties

An issue was discovered in Gazie 7.32. A successful installation does not remove or block or in any other way prevent use of its own file /setup/install/setup.php, meaning that anyone can request it without authentication. This file allows arbitrary PHP file inclusion via a hiddenreq POST paramet...

PT-2020-13235

Name of the Vulnerable Software and Affected Versions Gazie version 7.32 Description A security issue was found where the installation of Gazie does not properly secure its own file /setup/install/setup.php. This allows unauthorized access to the file, which can be exploited to include arbitrary...

CVE-2018-11686

The Publish Service in FlexPaper later renamed FlowPaper 2.3.6 allows remote code execution via setup.php and changeconfig.php...

Remote code execution

The Publish Service in FlexPaper later renamed FlowPaper 2.3.6 allows remote code execution via setup.php and changeconfig.php...

CVE-2018-11686

CVE-2018-11686 affects FlexPaper/FlowPaper 2.3.6 . The Publish Service allows remote code execution via setup.php and change_config.php , enabling unauthenticated attackers to run arbitrary code on the server and potentially compromise the host and all hosted documents. Remediation: upgrade to Fl...

PT-2019-8788

Name of the Vulnerable Software and Affected Versions FlexPaper versions 2.3.6 and earlier Description The issue allows remote code execution via setup.php and change config.php. Recommendations For FlexPaper version 2.3.6, consider disabling access to setup.php and change config.php as a tempora...

CVE-2018-11686: Improper Input Validation

The Publish Service in FlexPaper later renamed FlowPaper 2.3.6 allows remote code execution via setup.php and changeconfig.php...

CVE-2019-9002

An issue was discovered in Tiny Issue 1.3.1 and pixeline Bugs through 1.3.2c. install/config-setup.php allows remote attackers to execute arbitrary PHP code via the databasehost parameter if the installer remains present in its original directory after installation is completed...

PT-2019-19303

Name of the Vulnerable Software and Affected Versions Tiny Issue versions 1.3.1 through 1.3.2c pixeline Bugs versions 1.3.1 through 1.3.2c Description An issue allows remote attackers to execute arbitrary PHP code via the database host parameter in the install/config-setup.php file if the install...

CVE-2019-9002: Missing Authorization

An issue was discovered in Tiny Issue 1.3.1 and pixeline Bugs through 1.3.2c. install/config-setup.php allows remote attackers to execute arbitrary PHP code via the databasehost parameter if the installer remains present in its original directory after installation is completed...

Code injection

OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter...

CVE-2017-16540

OpenEMR before 5.0.0 Patch 5 allows unauthenticated remote database copying because setup.php exposes functionality for cloning an existing OpenEMR site to an arbitrary attacker-controlled MySQL server via vectors involving a crafted state parameter...