166 matches found
CVE-2020-35337: Improper Neutralization of Special Elements used in an SQL Command
ThinkSAAS before 3.38 contains a SQL injection vulnerability through app/topic/action/admin/topic.php via the title parameter, which allows remote attackers to execute arbitrary SQL commands...
SQL Injection Vulnerability in ThinkSaaS Open Source Community Foundation Edition
ThinkSAAS open source community is a lightweight open source community system , is a community system that can be used to build discussion groups , bbs and circles . ThinkSaaS Open Source Community Basic Edition suffers from a SQL injection vulnerability . Attackers can exploit the vulnerability ...
ThinkSAAS open source community ThinkSAAS has xss vulnerability
ThinkSAAS open source community is a lightweight open source community system , is a community system that can be used to build discussion groups , bbs and circles . thinksaas open source community thinksaas xss vulnerability , attackers can use the vulnerability to obtain sensitive information...
CVE-2019-16665
An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element...
CVE-2019-16664
An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter...
CVE-2019-16665
An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element...
CVE-2019-16664
An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter...
Design/Logic Flaw
An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter...
Design/Logic Flaw
An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element...
CVE-2019-16664
An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter...
CVE-2019-16664
ThinkSAAS 2.91 is affected by CVE-2019-16664: an XSS via the parameter groupname in index.php?app=group&ac=create&ts=do. Root cause described across sources is insufficient sanitization of the groupname input, enabling cross-site scripting. Affected product/version: ThinkSAAS 2.91. The Red Hat ad...
CVE-2019-16665
An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element...
CVE-2019-16665
ThinkSAAS 2.91 is affected by an XSS in the group comments page triggered by a crafted SVG in the SRC attribute of an EMBED element, via the URL index.php?app=group&ac=comment&ts=do&js=1. The issue stems from unsanitized SVG content, allowing script execution. CVSS metrics from NVD indicate CVSS ...
CVE-2019-16664: Improper Neutralization of Input During Web Page Generation
An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter...
CVE-2019-16665: Improper Neutralization of Input During Web Page Generation
An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element...
Stored Cross-Site Scripting Vulnerability in ThinkSAAS
ThinkSAAS is a lightweight open source community system that can be used to build discussion groups, bbs and circles. A stored cross-site scripting vulnerability exists in ThinkSAAS. An attacker can insert malicious js code into a page to obtain user cookies and other information, leading to user...
ThinkSAAS Cross-Site Scripting Vulnerability (CNVD-2018-14998)
ThinkSAAS is an open source community development system based on PHP and MySQL. A cross-site scripting vulnerability exists in ThinkSAAS 2018-07-25 and earlier versions. A remote attacker can exploit the vulnerability by sending the 'groupdesc' parameter to the index.php?app=group&ac=create&ts=d...
Code injection
ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter...