CVE-2018-11018: Cross-Site Request Forgery (CSRF)

An issue was discovered in PbootCMS v1.0.7. Cross-site request forgery CSRF vulnerability in apps/admin/controller/system/RoleController.php allows remote attackers to add administrator accounts via admin.php/role/add.html...

PT-2018-9765

Name of the Vulnerable Software and Affected Versions: YzmCMS version 3.8 Description: An issue was discovered that allows for a CSRF vulnerability, enabling the addition of an admin account via the "/index.php/admin/admin manage/add.html" API endpoint. Recommendations: For YzmCMS version 3.8,...

PT-2018-9766

Name of the Vulnerable Software and Affected Versions: YzmCMS version 3.8 Description: A CSRF issue allows adding a tag via the "/index.php/admin/tag/add.html" API endpoint. Recommendations: For YzmCMS version 3.8, consider implementing CSRF protection measures to prevent unauthorized actions, su...

CVE-2018-10224: Cross-Site Request Forgery (CSRF)

An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html...

CVE-2018-10223: Cross-Site Request Forgery (CSRF)

An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/adminmanage/add.html...

PT-2017-18535

Name of the Vulnerable Software and Affected Versions Accellion FTA versions prior to FTA 9 12 180 Description An issue was discovered in Accellion FTA devices, where there is a cross-site scripting XSS vulnerability in the "home/seos/courier/smtpg add.html" endpoint with the param parameter...

PT-2017-18532

Name of the Vulnerable Software and Affected Versions Accellion FTA versions prior to FTA 9 12 180 Description An issue was discovered in Accellion FTA devices. There is a cross-site scripting XSS issue in the "home/seos/courier/user add.html" endpoint with the param parameter. Recommendations Fo...

PT-2015-5901

Name of the Vulnerable Software and Affected Versions Alcatel-Lucent OmniSwitch versions 6.4.5.R02 through 8.1.1.R01 Description A cross-site request forgery CSRF issue exists in the management web interface, specifically in the sec/content/sec asa users local db add.html file. This allows remote...

PT-2011-1927

Name of the Vulnerable Software and Affected Versions Joomla! Payments Plus component version 2.1.5 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the type parameter to the "add.html" endpoint. Recommendations For version 2.1.5, consider...

CVE-2010-4992: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Payments Plus component 2.1.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the type parameter to add.html...