CVE-2017-17937

Vanguard Marketplace Digital Products PHP has XSS via the phpsquery parameter to /search...

CVE-2017-17936

Vanguard Marketplace Digital Products PHP has CSRF via /search...

Cross site request forgery (csrf)

Vanguard Marketplace Digital Products PHP has CSRF via /search...

CVE-2017-17936

Vanguard Marketplace Digital Products PHP has CSRF via /search...

CVE-2017-17936

CVE-2017-17936 affects Vanguard Marketplace Digital Products PHP and is described as a Cross-Site Request Forgery (CSRF) vulnerability that can be triggered via the /search endpoint. Connected documents from CNVD-2018-01117 and RH/Red Hat corroborate the CSRF via /search, with NVD similarly notin...

CVE-2017-17937

Vanguard Marketplace Digital Products PHP has XSS via the phpsquery parameter to /search...

CVE-2017-17937

Vanguard Marketplace Digital Products PHP is affected by a cross-site scripting (XSS) vulnerability in the phps_query parameter of the /search endpoint. The issue is consistently reported across multiple feeds (CVE-2017-17937 references) and appears in Red Hat, CNVD, NVD, and CVE records as a PHP...

CVE-2017-17937: Improper Neutralization of Input During Web Page Generation

Vanguard Marketplace Digital Products PHP has XSS via the phpsquery parameter to /search...

CVE-2017-17936: Cross-Site Request Forgery (CSRF)

Vanguard Marketplace Digital Products PHP has CSRF via /search...

CVE-2017-17873

Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATHINFO to the /p URI...

CVE-2017-17874

Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...

CVE-2017-17873

Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATHINFO to the /p URI...

CVE-2017-17874

Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...

CVE-2017-17873

Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATHINFO to the /p URI...

CVE-2017-17874

Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...

Sql injection

Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATHINFO to the /p URI...

Default credentials

Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...

CVE-2017-17874: Unrestricted Upload of File with Dangerous Type

Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI...

CVE-2017-17873: Improper Neutralization of Special Elements used in an SQL Command

Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATHINFO to the /p URI...

CVE-2017-17873

CVE-2017-17873 affects Vanguard Marketplace Digital Products PHP 1.4. It describes an SQL injection via PATH_INFO to the /p URI in the PHP-based scripts used for online trading, allowing potentially unauthorized access to data with network-exposed risk. The CVSSv3 vector is CVSS:3.0/AV:N/AC:L/PR:...