CVE-2020-23376

NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parameter to launch a stored XSS attack...

CVE-2020-23376: Cross-Site Request Forgery (CSRF)

NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parameter to launch a stored XSS attack...

CVE-2020-23374: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/article/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter...

CVE-2020-23373: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/nav/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter...

PT-2021-10894

Name of the Vulnerable Software and Affected Versions noneCMS version 1.3.0 Description A cross-site scripting XSS issue allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter in the admin/article/add.html page. Recommendations For noneCMS version 1.3....

PT-2021-10893

Name of the Vulnerable Software and Affected Versions noneCMS version 1.3.0 Description A cross-site scripting XSS issue allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter in the admin/nav/add.html file. Recommendations For noneCMS version 1.3.0,...

PT-2019-14763

Name of the Vulnerable Software and Affected Versions YzmCMS version 5.3 Description The issue in YzmCMS allows for a Cross-Site Request Forgery CSRF attack, which can lead to a denial of service. This occurs when an attacker can add a superseding route, affecting the system's functionality. The...

CVE-2019-16678: Cross-Site Request Forgery (CSRF)

admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route...

PT-2019-8420

Name of the Vulnerable Software and Affected Versions Cognitoys Dino devices affected versions not specified Description The issue allows for a CSRF attack on the profiles add.html page. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

PT-2019-9280

Name of the Vulnerable Software and Affected Versions YzmCMS version 5.1 Description The issue is related to a Cross-Site Scripting XSS problem. It occurs via the title parameter in the admin/system manage/user config add.html page. Recommendations For YzmCMS version 5.1, avoid using the title...

Sql injection

whatsns 4.0 allows index.php?inform/add.html qid SQL injection...

CVE-2019-11451

CVE-2019-11451 affects the web app "whatsns 4.0". A SQL injection vulnerability exists in the parameterized endpoint: index.php?inform/add.html with the qid parameter. The root cause is unsanitized input leading to SQL injection, enabling an attacker to potentially read/modify data and affect ava...

CVE-2019-11451

whatsns 4.0 allows index.php?inform/add.html qid SQL injection...

PT-2019-12316

Name of the Vulnerable Software and Affected Versions whatsns version 4.0 Description The issue allows for SQL injection through the qid variable in the /index.php?inform/add.html endpoint. Recommendations For version 4.0, avoid using the qid variable in the /index.php?inform/add.html endpoint...

CVE-2019-11451: Improper Neutralization of Special Elements used in an SQL Command

whatsns 4.0 allows index.php?inform/add.html qid SQL injection...

PT-2019-12080

Name of the Vulnerable Software and Affected Versions UKcms version 1.1.10 Description A CSRF issue was discovered that can add an admin user. The issue is related to the "admin.php/admin/role/add.html" API endpoint. Recommendations For UKcms version 1.1.10, update to a newer version that contain...

CVE-2019-10888: Cross-Site Request Forgery (CSRF)

A CSRF Issue that can add an admin user was discovered in UKcms v1.1.10 via admin.php/admin/role/add.html...

PT-2018-15467

Name of the Vulnerable Software and Affected Versions Lei Feng TV CMS aka LFCMS version 3.8.6 Description The issue allows for a CSRF attack on the admin.php?s=/Member/add.html endpoint. Recommendations For Lei Feng TV CMS aka LFCMS version 3.8.6, consider implementing CSRF protection measures,...

CVE-2018-20603: Cross-Site Request Forgery (CSRF)

Lei Feng TV CMS aka LFCMS 3.8.6 allows admin.php?s=/Member/add.html CSRF...

CVE-2018-20367: Improper Neutralization of Input During Web Page Generation

The "mall some commodity details: commodity consultation" component in WSTMart 2.0.8181212 has stored XSS via the consultContent parameter, as demonstrated by the index.php/home/goodsconsult/add.html URI...