CVE-2017-6511

andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the action parameter in application/classes/application.php...

PT-2017-17124 · Andrzuk · Finecms

Name of the Vulnerable Software and Affected Versions: andrzuk/FineCMS versions prior to 2017-03-06 Description: The issue is related to a reflected XSS in index.php due to missing validation of the action parameter in application/classes/application.php. Recommendations: For versions prior to...

CVE-2017-6511: Improper Neutralization of Input During Web Page Generation

andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the action parameter in application/classes/application.php...

CVE-2016-0765

Multiple cross-site scripting XSS vulnerabilities in eshop-orders.php in the eShop plugin 6.3.14 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 page or 2 action parameter...

PT-2017-7653

Name of the Vulnerable Software and Affected Versions eShop plugin version 6.3.14 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the page or action parameter in the...

phpFileManager cmd Parameter Command Execution

A remote command execution vulnerability exists in phpFileManager. The vulnerability is due to a design weakness when handling HTTP requests with "action" parameter set to 6 or 9. A remote user can exploit this vulnerability by injecting arbitrary command in the "cmd" parameter...

CVE-2015-5151

Cross-site scripting XSS vulnerability in the Slider Revolution revslider plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the clientaction parameter in a revsliderajaxaction action to wp-admin/admin-ajax.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the Slider Revolution revslider plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the clientaction parameter in a revsliderajaxaction action to wp-admin/admin-ajax.php...

PT-2015-5248

Name of the Vulnerable Software and Affected Versions ferretCMS version 1.0.4-alpha Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters. The affected parameter...

CVE-2015-0917

Cross-site scripting XSS vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php...

CVE-2015-0917: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php...

PT-2015-4967

Name of the Vulnerable Software and Affected Versions Kajona versions prior to 4.6.3 Description A cross-site scripting XSS issue exists in the backend of Kajona, allowing remote attackers to inject arbitrary web script or HTML via the action parameter to "index.php". Recommendations For versions...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2011-5307

Cross-site scripting XSS vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2011-5307: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...

PT-2015-3503

Name of the Vulnerable Software and Affected Versions PhotoSmash plugin version 1.0.1 for WordPress Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the action parameter in the index.php file...

PT-2014-8618

Name of the Vulnerable Software and Affected Versions JExperts Channel Platform version 5.0.33 CCB Description The issue allows remote authenticated users to bypass access restrictions. This is achieved by using crafted action and key parameters. Recommendations For JExperts Channel Platform...

CVE-2014-7290

Multiple cross-site scripting XSS vulnerabilities in Atlas Systems Aeon 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 Action or 2 Form parameter to aeon.dll...

CVE-2014-7290: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Atlas Systems Aeon 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 Action or 2 Form parameter to aeon.dll...

PT-2014-7884

Name of the Vulnerable Software and Affected Versions Aeon versions 3.5 through 3.6 Description The issue allows remote attackers to inject arbitrary web script or HTML. This is achieved via the Action or Form parameter to the "aeon.dll" endpoint. Recommendations For versions 3.5 and 3.6, conside...