CVE-2019-25367: Improper Neutralization of Input During Web Page Generation

ArangoDB Community Edition 3.4.2-1 contains multiple cross-site scripting vulnerabilities in the Aardvark web admin interface index.html through search, user management, and API parameters. Attackers can inject scripts via parameters in /db/system/admin/aardvark/index.html to execute JavaScript i...

CVE-2023-27179: Unrestricted Upload of File with Dangerous Type

GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /admin/imgdownload.php...

CVE-2023-27180: Files or Directories Accessible to External Parties

GDidees CMS v3.9.1 was discovered to contain a source code disclosure vulnerability by the backup feature which is accessible via /admin/backup.php...

CVE-2015-5285: Undefined Security Weakness

CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the camefrom parameter to admin/login...

CVE-2009-3802

Amiro.CMS 5.4.0.0 and earlier allows remote attackers to obtain sensitive information via an invalid loginname "%%%" to admin/index.php, which reveals the installation path and other information in an error message...

CVE-2009-3802: Improper Input Validation

Amiro.CMS 5.4.0.0 and earlier allows remote attackers to obtain sensitive information via an invalid loginname "%%%" to admin/index.php, which reveals the installation path and other information in an error message...

CVE-2007-1156: Undefined Security Weakness

JBrowser allows remote attackers to bypass authentication and access certain administrative capabilities via a direct request for admin/...

CVE-2007-0301: Undefined Security Weakness

PHP remote file inclusion vulnerability in admin/adminmenu.php in FdWeB Espace Membre 2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the path parameter...