202 matches found
phpMyFAQ CSV Injection Vulnerability
phpMyFAQ is phpMyFAQ team developed a set of open source fully database-driven FAQ question and answer system . The system supports multiple languages, multiple databases, etc., and includes modules such as content management system and community. A CSV injection vulnerability exists in the admin...
CVE-2018-16651: Improper Neutralization of Formula Elements in a CSV File
The admin backend in phpMyFAQ before 2.9.11 allows CSV injection in reports...
Override Access Vulnerability in SiteServer CMS Administration Backend
SiteServer CMS is a web content management system developed by Beijing Billion Software Technology Development Co. A vulnerability exists in the management background of SiteServer CMS. The vulnerability is due to the background access control using JWT technology for identity authentication, HTT...
javapms admin backend template injection code execution vulnerability
JAVAPMS is a JAVA Portal Management System JAVA Portal Management System for short, SpringMVC + Spring + Hibernate + Freemarker + Html5 + jQuery for the technical core architecture, for the majority of webmasters, software developers, program enthusiasts, web page designers, for individual...
Piwigo SQL Injection Vulnerability
Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time and more. A SQL injection vulnerability exists in the administrative backend of Piwigo 2.9.1 and previous versions. A remote attack...
DedeCMS stored xss vulnerability
Vulnerability description: Dedecms is an open source PHP open source website management system. Dedecms member function shopsdelivery. in php des parameters there is stored XSS vulnerability, the attacker may exploit the vulnerability to obtain the users cookie. Test environment: DedeCMS-V5...
Jobberbase 2.0 - Multiple Vulnerabilities
Exploit for php platform in category web applications Jobberbase: http://www.jobberbase.com/ Version: 2.0 By Ross Marks: http://www.rossmarks.co.uk 1 Local path disclosure - change any variable to an array and in most cases it will tell you the local path where the application is installed eg...
Reflective XSS Vulnerability in EasyCMS Enterprise Marketing Management System Administration Backend
EasyCMS is a web content management system based on PHP+Mysql architecture. A reflective XSS vulnerability exists in the administration backend of the EasyCMS enterprise marketing management system, which can be exploited by an attacker to submit data with js code on the personal information page...
Liferay Portal 6.2 EE SP13 Cross Site Scripting
Hey guys, during a penatrationtest I have found an unknown persistent xss in liferay portal backend. General Information Manufacture description: Liferay Portal is an enterprise-web-platform for the development of business solutions, which provides quick results and long-term values. Details ·...
CVE-2015-2149
Multiple cross-site scripting XSS vulnerabilities in the administrative backend in MyBB aka MyBulletinBoard before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the 1 MIME-type field in an add action in the config-attachmenttypes module to admin/index.php; 2...
CVE-2015-2183
ZeusCart 4 (open source PHP/MySQL e‑commerce) is affected by multiple SQL injection vulnerabilities in the administrative backend. The flaws allow remote administrators to inject arbitrary SQL via the id parameter in disporders detail or subadminmgt edit actions, or via the cid parameter in editc...
CVE-2015-2035
SQL injection vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote administrators to execute arbitrary SQL commands via the user parameter in the history page to admin.php...
CVE-2015-1442
CVE-2015-1442 describes a SQL injection in ZeroCMS. Affected: ZeroCMS versions 1.3.3, 1.3.2 and earlier. Vulnerability located in views/zero_transact_user.php (administrative backend) where the user_id parameter in a Modify Account action can be exploited by remote authenticated users to execute ...
CVE-2015-1040
Summary (CVE-2015-1040): Multiple XSS vulnerabilities in the administrative backend of BEdita 3.4.0 allow remote authenticated users to inject arbitrary script/HTML via several fields (lrealname in editProfile; data[title] or data[description] in addQuickItem; note text in saveNote; titleBEObject...
CVE-2015-0919
Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before 1.6.1 allow remote administrators to execute arbitrary SQL commands via the 1 idcat or 2 idclient parameter to backend/main.php...
CVE-2014-9434
Cross-site scripting XSS vulnerability in admin/managerrelated.php in the administrative backend in Absolut Engine 1.73 allows remote authenticated users to inject arbitrary web script or HTML via the title parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in admin/managerrelated.php in the administrative backend in Absolut Engine 1.73 allows remote authenticated users to inject arbitrary web script or HTML via the title parameter...
方维团购最新版通杀注入（附大量案例）
简要描述： RT $$$$$$$$$$$$$$$$$$$$$$$ 详细说明： 官网没成功。但是基本通杀。 存在问题的地方是这个登录接口：m.php?m=User&a=doLogin post：origURL=ghost&password=ghost&email=ghost（email参数没有过滤） 报错注入 http://www.qianrengou.com/m.php?m=User&a=doLogin post：post：origURL=ghost&password=ghost&email=ghost 默认后台：admin.php...
dl_stats Multiple Vulnerabilities
No description provided by source. :::::::::::::::::::::::::::::::::::::: 0x1 :::::::::::::::::::::::::::::::::::::: |:: General Information |:: Advisory/Exploit Title = dlstats Multiple Vulnerabilitie |:: Author = Valentin Hoebel |:: Contact = [email protected] |:: |::...