Cross site request forgery (csrf)

TuziCMS 2.0.6 has index.php/manage/link/doadd CSRF...

CVE-2019-16657

TuziCMS 2.0.6 has XSS via the PATHINFO to a group URI, as demonstrated by index.php/article/group/id/2/...

CVE-2019-16657

CVE-2019-16657 affects TuziCMS 2.0.6. The vulnerability is an XSS via PATH_INFO to a group URI (example: index.php/article/group/id/2/). Documented impact suggests partial integrity and low confidentiality impact with network exposure; exploitation details are not provided beyond the example path...

CVE-2019-16658

TuziCMS 2.0.6 is affected by a CSRF vulnerability in the endpoint index.php/manage/notice/do_add . The provided documents identify the root cause as a CSRF issue at that endpoint. No exploitation specifics or remediation steps are given in the sources. If present, check for interim mitigations; o...

CVE-2019-16658

TuziCMS 2.0.6 has index.php/manage/notice/doadd CSRF...

CVE-2019-16659

TuziCMS 2.0.6 has index.php/manage/link/doadd CSRF...

CVE-2019-16659

The connected sources confirm CVE-2019-16659 affects TuziCMS 2.0.6, describing a CSRF issue in index.php/manage/link/do_add. The root cause is a Cross-Site Request Forgery vulnerability in that endpoint, enabling unauthorized state-changing requests from a logged-in user. Exploit details, affecte...

CVE-2019-16644

App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring...

Sql injection

App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring...

CVE-2019-16644

Summary of CVE-2019-16644 : The vulnerability affects TuziCMS 2.0.6, specifically in App\Home\Controller\ZhuantiController.class.php. It enables SQL injection via the request path index.php/Zhuanti/group?id= (substring) and impacts the application’s data integrity and potentially confidentiality,...

CVE-2019-16644

App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring...

CVE-2019-16642

App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring...

Sql injection

App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring...

CVE-2019-16642

App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring...

CVE-2019-16642

CVE-2019-16642 affects TuziCMS 2.0.6. Affected component: App\Mobile\Controller\ZhuantiController.class.php, vulnerable to SQL injection via the index.php/Mobile/Zhuanti/group?id= parameter. Root cause described as unsafe handling of user input in ZhuantiController; impact includes data exposure ...

TuziCMS Cross-Site Request Forgery Vulnerability

TuziCMS is an enterprise web content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in TuziCMS version 2.0.6. A remote attacker can exploit the vulnerability to add an administrator account...

Cross site request forgery (csrf)

An issue was discovered in TuziCMS v2.0.6. There is a CSRF vulnerability that can add an admin account, as demonstrated by a history.pushState call...

CVE-2018-10185

An issue was discovered in TuziCMS v2.0.6. There is a CSRF vulnerability that can add an admin account, as demonstrated by a history.pushState call...

CVE-2018-10185

An issue was discovered in TuziCMS v2.0.6. There is a CSRF vulnerability that can add an admin account, as demonstrated by a history.pushState call...

CVE-2018-10185

CVE-2018-10185 affects TuziCMS v2.0.6. The issue is a Cross-Site Request Forgery (CSRF) vulnerability that can add an administrator account, demonstrated via a history.pushState call. Impact/summary: attacker-triggered CSRF can escalate to admin rights on affected deployments. The Red Hat and CNV...