WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress plugin Advanced Custom Fields Pro versions...

ASUS RT-AC1900P routers cross-site scripting vulnerability

ASUS RT-AC1900P routers is a router device. A cross-site scripting vulnerability exists in the ASUS RT-AC1900P routers firmware update page, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to gain access to sensitive information or hijack user...

Realization Concerto Critical Chain Planner SQL Injection Vulnerability

Realization Concerto Critical Chain Planner CCPM is a project management software package. A SQL injection vulnerability exists in the taskupdt/taskdetails.aspx web page in Realization CCPM version 5.10.8071. The vulnerability stems from a database-based application that lacks validation of...

PHP Scripts Mall Chartered Accountant:Auditor Website Cross-Site Scripting Vulnerability

PHP Scripts Mall Chartered Accountant:Auditor Website is an accounting auditor website system script from PHP Scripts Mall, India. A cross-site scripting vulnerability exists in the Profile Update page in PHP Scripts Mall Chartered Accountant : Auditor Website version 2.0.1, which can be exploite...

CVE-2019-7553

PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field...

CVE-2019-7553: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field...

DouCo DouPHP Cross-Site Scripting Vulnerability (CNVD-2019-00999)

DouCo DouPHP is a lightweight open source CMS Content Management System based on PHP and MySQL. A cross-site scripting vulnerability exists in admin/article.php?rec=update in DouCo DouPHP version 1.5 20181221. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

CVE-2018-20559

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product.php?rec=update has XSS via the name parameter...

CVE-2018-20564

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/productcategory.php?rec=update has XSS via the catname parameter...

CVE-2018-20558

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/system.php?rec=update has XSS via the sitename parameter...

CVE-2018-18952

JEECMS 9.3 has XSS via an index.do/content/update?type=update URI...

CVE-2017-6917

CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. The Colophon can be changed...

WordPress Encrypted Contact Form plugin cross-site request forgery vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Encrypted Contact Form plugin is a WordPress plugin that uses end-to-end encryption to send user information. A...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the iframeurl parameter in an Update Page action in the...

CVE-2015-4010

CVE-2015-4010 concerns the WordPress plugin “Encrypted Contact Form”. The vulnerability is a CSRF that also enables reflected XSS via unsanitized iframe_url data in the Update Page operation of the conformconf page, affecting admin actions in wp-admin/options-general.php. Affected versions are 1....

CVE-2015-4010

Cross-site request forgery CSRF vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the iframeurl parameter in an Update Page action in the...

CVE-2015-4010: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the iframeurl parameter in an Update Page action in the...

SQL injection vulnerability in the id parameter in Ticketmaster ERP web-based ticketing system/flight/refund_update.aspx?id=.

Ltd. Ticketmaster ERP management system is a special ticket management system for air ticket agents, integrating online booking management, telephone recording screen, corporate travel management, order management in the same industry, membership management, points management, SMS sending, staff...

DmxReady Faqs Manager 1.2 SQL Injection

Exploit Title: DmxReady Faqs Manager v1.2 SQL Injection Vulnerability Google Dork: inurl:incfaqsmanager.asp Date: 03.07.2011 Author: Bellatrix Software Link: http://www.dmxready.com/?product=faqs-manager-v1 Version: v1.2 Language: ASP Price : $99.97 Tested on: Windows XP Sp3 Greetz : VoLqaN ,...

CVE-2008-4727

Cross-site scripting XSS vulnerability in the contact update page ss/bwgkoemr.PUpdateEmrgContacts in SunGard Banner Student 7.3 allows remote attackers to inject arbitrary web script or HTML via the addr1 parameter. NOTE: this might be resultant from a CSRF vulnerability, but there are insufficie...