PT-2022-19062

Name of the Vulnerable Software and Affected Versions ZCMS version v20170206 Description A stored cross-site scripting XSS issue was found in ZCMS. The issue is exploited via the index.php endpoint with specific parameters: m=home, c=message, and a=add. This allows for malicious script execution...

CVE-2022-28522: Improper Neutralization of Input During Web Page Generation

ZCMS v20170206 was discovered to contain a stored cross-site scripting XSS vulnerability via index.php?m=home&c=message&a=add...

PT-2021-10637

Name of the Vulnerable Software and Affected Versions: waimai Super Cms version 20150505 Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability is located in the /admin.php?m=Config&a=add component. Cross-site scripting XSS is a type of security...

PT-2021-10479

Name of the Vulnerable Software and Affected Versions: WTCMS version 1.0 Description: The issue is related to a cross-site request forgery CSRF vulnerability. This vulnerability is located in the "index.php?g=admin&m=nav&a=add post" component, which allows attackers to arbitrarily add articles in...

PT-2021-10393

Name of the Vulnerable Software and Affected Versions: thinkphp-zcms as of 20190715 Description: The issue allows SQL injection via the "index.php?m=home&c=message&a=add" API endpoint. This could potentially lead to unauthorized access to sensitive data. Recommendations: For thinkphp-zcms as of...

CVE-2020-18648: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF in JuQingCMS v1.0 allows remote attackers to gain local privileges via the component "JuQingCMSv1.0/admin/index.php?c=administrator&a=add"...

CVE-2020-35346

CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add...

PT-2020-17312

Name of the Vulnerable Software and Affected Versions CXUUCMS V3 version 3.1 Description The issue allows an attacker to add an administrator account via a CSRF vulnerability. This can be exploited through the "admin.php?c=adminuser&a=add" endpoint. Recommendations For CXUUCMS V3 version 3.1, as ...

PT-2020-17311

Name of the Vulnerable Software and Affected Versions CXUUCMS V3 version 3.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of "admin.php?c=content&a=add". This enables attackers to perform a reflected XSS attack. Recommendations For...

CVE-2019-11374: Cross-Site Request Forgery (CSRF)

74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI...

PT-2019-12265

Name of the Vulnerable Software and Affected Versions 74CMS version 5.0.1 Description The issue allows an attacker to add a new admin user via the "index.php?m=Admin&c=admin&a=add" API endpoint. This is due to a CSRF vulnerability. Recommendations For version 5.0.1, update to a newer version that...

PT-2019-19798

Name of the Vulnerable Software and Affected Versions sftnow versions prior to 2018-12-29 Description The issue allows for a CSRF attack via the "index.php?g=Admin&m=User&a=add post" endpoint to add an admin account. Recommendations For versions prior to 2018-12-29, update to a version released...

PT-2019-18731

Name of the Vulnerable Software and Affected Versions Verydows version 2.0 Description A CSRF issue was discovered that allows adding an admin account via the "index.php?m=backend&c=admin&a=add&step=submit" endpoint, specifically by manipulating the a and step variables. Recommendations For versi...

PT-2018-15476

Name of the Vulnerable Software and Affected Versions UWA version 2.3.11 Description The issue allows for a CSRF attack via the index.php?g=admin&c=admin&a=add admin do endpoint. Recommendations For version 2.3.11, consider implementing CSRF protection measures, such as token-based validation, to...

PT-2018-14852

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue was discovered in XiaoCms, where the API endpoint "admin/index.php?c=content&a=add&catid=3" is vulnerable to CSRF attacks. This can be exploited by entering news via the datacontent parameter...

PT-2018-13484

Name of the Vulnerable Software and Affected Versions waimai Super Cms version 20150505 Description The issue allows for a change in configuration via the admin.php?m=Config&a=add endpoint. This is achieved through a CSRF vulnerability, which can be exploited to modify settings without the user's...

PT-2018-10237

Name of the Vulnerable Software and Affected Versions SDcms version 1.5 Description A cross-site request forgery CSRF issue allows remote attackers to add administrator accounts. This is possible via the "/WWW//app/admin/controller/admincontroller.php" endpoint with parameters such as m=admin,...