CVE-2018-12622: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the fieldname parameter...

PT-2019-8906

Name of the Vulnerable Software and Affected Versions Eventum version 3.5.0 Description An issue was discovered in the software, where the htdocs/ajax/update.php endpoint has a cross-site scripting XSS vulnerability via the field name parameter. Recommendations For Eventum version 3.5.0, avoid...

PT-2018-13913

Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description The issue allows admin users to execute arbitrary code via the attrvalue array parameter in the 'admin/goods update.php' file. Recommendations For PHPMyWind version 5.5, avoid using the attrvalue array paramet...

QYKCMS update.php page has an arbitrary file deletion vulnerability

QYKCMS is a lightweight intelligent website building system based on PHP+MySql developed by QYK. QYKCMS update.php page exists arbitrary file deletion vulnerability. Allow attackers to exploit the vulnerability to delete arbitrary files, such as deleting install.lck for CMS reloading, hijacking t...

PT-2017-7256

Name of the Vulnerable Software and Affected Versions Support Ticket System plugin versions prior to 1.2.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the user or id parameter in the includes/update.php file. Recommendations For versions...

CVE-2015-7670: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System plugin before 1.2.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 user or 2 id parameter...

PT-2017-12823

Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.3 Description The issue is related to a problem in the shoppingcart.php file, which is also connected to message.php, admin/message.php, and admin/message update.php. This problem allows for XSS. Recommendations For PHPMyWi...

CVE-2017-9444

BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script modify user information, the index.php/admin/developer/packages/delete/ URI remove packages, the index.php/admin/developer/upgrade/ignore/?versions= URI, and the...

CVE-2017-9444: Cross-Site Request Forgery (CSRF)

BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script modify user information, the index.php/admin/developer/packages/delete/ URI remove packages, the index.php/admin/developer/upgrade/ignore/?versions= URI, and the...

PT-2017-18926

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.19 Description The issue is related to CSRF, allowing modification of user information, removal of packages, ignoring versions, and setting FTP directories. Specifically, it affects the...

Steam Profile Integration 2.0.11 - SQL injection

Steam Profile Integration 2.0.11 - SQL injection Exploit Title: IPS Community Suite - Steam Profile Integration 2.0.11 and below SQL injection Google Dork: inurl:tab=nodesteamsteamprofile Date: 13/03/2017 Exploit Author: DrWhat Vendor Homepage:...

akasa.cn XSS vulnerability

Vulnerable URL: http://akasa.cn/update.php?no=181=AK-HPC01-BK="=product/product.detail.tplsub=2.5 Enclosure Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 14:48 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

akasa.biz XSS vulnerability

Vulnerable URL: http://www.akasa.biz/update.php?no=181="=Notebook coolers=product/product.detail.tplsub=NB Coolers Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

PT-2015-7542

Name of the Vulnerable Software and Affected Versions refbase versions through 0.9.6 refbase bleeding-edge versions through 2015-04-28 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the adminUserName, pathToMYSQL,...

CVE-2015-7383: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Web Reference Database aka refbase through 0.9.6 and bleeding-edge through 2015-04-28 allow remote attackers to inject arbitrary web script or HTML via the 1 adminUserName, 2 pathToMYSQL, 3 databaseStructureFile, or 4 pathToBibutils parameter t...

PT-2014-6321

Name of the Vulnerable Software and Affected Versions yawpp plugin version 1.2 Description The issue allows remote authenticated users with Contributor privileges to execute arbitrary SQL commands. This can be achieved via vectors related to admin functions.php or admin update.php. For example, t...

Logaholic update.php page Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/27003/info Logaholic is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues, a cross-site scripting issue, and an HTML-injection issue. The issues occur because the application fail...

osCommerce <= 2.2 (extras) Source Code Disclosure Vulnerability

No description provided by source. ---- osCommerce = 2.2 extras/ information/source code disclosure ------------ software site: http://www.oscommerce.com/ if extras/ folder is placed inside the www path, you can see all files on target system, including php source code with database details, poc:...

CVE-2013-5313

Cross-site request forgery CSRF vulnerability in core/admin/modules/users/update.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify arbitrary user accounts via an edit user action...

CVE-2013-5313: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in core/admin/modules/users/update.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify arbitrary user accounts via an edit user action...