336 matches found
CVE-2017-14530
WPAdminUI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstrated by inserting XSS sequences...
WordPress surveys 'action' variable SQL injection vulnerability
WordPress is a set of blogging platform developed by WordPress Software Foundation using PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.WordPress surveys is a polls plugin developed by Binny VA, an Indian software developer for Wordpress. A SQL injection...
CVE-2017-14416
D-Link DIR-850L REV. A with firmware through FW114WWb07h2abbeta1 devices have XSS in the action parameter to htdocs/web/wandetect.php...
CVE-2017-14415
D-Link DIR-850L REV. A with firmware through FW114WWb07h2abbeta1 devices have XSS in the action parameter to htdocs/web/sitesurvey.php...
PT-2017-13459 · D Link · D-Link Dir-850L
Name of the Vulnerable Software and Affected Versions: D-Link DIR-850L REV. A versions through FW114WWb07 h2ab beta1 Description: The issue concerns a problem where an attacker can execute malicious scripts. This is possible due to the presence of a cross-site scripting XSS flaw in the action...
PT-2017-13457 · D Link · D-Link Dir-850L
Name of the Vulnerable Software and Affected Versions: D-Link DIR-850L REV. A versions through FW114WWb07 h2ab beta1 Description: The issue concerns a problem where an attack can be performed. The action parameter in the /htdocs/web/wpsacts.php endpoint is vulnerable. Recommendations: For D-Link...
PT-2017-13460 · D Link · D-Link Dir-850L
Name of the Vulnerable Software and Affected Versions: D-Link DIR-850L REV. A versions through FW114WWb07 h2ab beta1 Description: The issue concerns a problem where an attack can be performed. The estimated number of potentially affected devices worldwide is not available. Details about real-worl...
PT-2017-13458 · D Link · D-Link Dir-850L
Name of the Vulnerable Software and Affected Versions: D-Link DIR-850L REV. A versions through FW114WWb07 h2ab beta1 Description: The issue concerns a problem where an attack can be performed. The action parameter in the /htdocs/web/shareport.php endpoint is vulnerable. Recommendations: For D-Lin...
Green Packet DX-350 Cross-Site Scripting Vulnerability
The Green Packet DX-350 is a network access point device from Green Packet USA. A cross-site scripting vulnerability exists in the Green Packet DX-350 using firmware version 2.8.9.5-g1.4.8-atheeb. A remote attacker can exploit the vulnerability by sending the 'action' parameter to the ajax.cgi fi...
DEBIAN-CVE-2017-1000032
Cross-Site scripting XSS vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the parentid parameter to tree.php and drpaction parameter to datasources.php...
MODX Revolution Directory Traversal Vulnerability (CNVD-2017-07464)
MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A directory traversal vulnerability exists in MODX Revolution versions prior to 2.5.7 using PHP version...
MantisBT Cross-Site Scripting Vulnerability (CNVD-2017-04629)
MantisBT is an open-source issue management system developed in PHP and commonly used for internal collaboration within corporate teams. A cross-site scripting vulnerability exists in the admconfigreport.php page in MantisBT 1.2.16 and later versions, which can be exploited to inject script or HT...
CVE-2017-6973
A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2...
CVE-2017-7250
A Cross-Site Scripting XSS was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data action passed to the 'Gazelle-master/sections/tools/finances/bitcoinbalance.php' URL. An attacker could execute arbitrary HTML and script code in a...
PT-2017-17124 · Andrzuk · Finecms
Name of the Vulnerable Software and Affected Versions: andrzuk/FineCMS versions prior to 2017-03-06 Description: The issue is related to a reflected XSS in index.php due to missing validation of the action parameter in application/classes/application.php. Recommendations: For versions prior to...
phpFileManager cmd Parameter Command Execution
A remote command execution vulnerability exists in phpFileManager. The vulnerability is due to a design weakness when handling HTTP requests with "action" parameter set to 6 or 9. A remote user can exploit this vulnerability by injecting arbitrary command in the "cmd" parameter...
CVE-2015-5151
Cross-site scripting XSS vulnerability in the Slider Revolution revslider plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the clientaction parameter in a revsliderajaxaction action to wp-admin/admin-ajax.php...
Cross site scripting
Cross-site scripting XSS vulnerability in the Slider Revolution revslider plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the clientaction parameter in a revsliderajaxaction action to wp-admin/admin-ajax.php...
Cross site scripting
Cross-site scripting XSS vulnerability in index.php in the PhotoSmash plugin 1.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter...
