MISP Information Disclosure Vulnerability

MISP is a suite of open source software solutions for collecting, storing, distributing and sharing cybersecurity metrics and threats cybersecurity event analysis and malware analysis. A security vulnerability exists in the 'adminedit' function of the app/Controller/UsersController.php file in MI...

PHPSUGAR PHP Melody SQL Injection Vulnerability (CNVD-2017-32539)

PHPSUGAR PHP Melody is a PHP-based content management system for video websites. A SQL injection vulnerability exists in PHPSUGAR PHP Melody versions prior to 2.7.3. A remote attacker can exploit this vulnerability by sending the 'image' parameter to the admin/editcategory.php file to inject SQL...

phpwcms Cross-Site Scripting Vulnerability

phpwcms is a flexible, fast, robust, customer and developer friendly and powerful web-based content management system and cms framework based on PHP and MySQL. A cross-site scripting vulnerability exists in include/inctmpl/admin.edituser.tmpl.php and include/inctmpl/admin.newuser.tmpl.php in...

CVE-2017-15578

In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/editcategory.php...

FineCMS stored cross-site scripting vulnerability (CNVD-2017-15721)

FineCMS is an efficient and simple small and medium-sized content management system based on PHP+MySql+CI framework development for multiple terminals, including Pc-side web pages and mobile web pages, support for customized content models and member models, and can be customized fields, can be...

WordPress WP Jobs Plugin SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.WP Jobs plugin is one of the post management plugin. A SQL injection vulnerability exists in WordPress WP Jobs plug...

Arbitrary Password Reset Vulnerability in 'Admin_Edit.aspx' File of Micro Xia Online Learning Platform

Micro Xia Online Learning Platform is an online education system based on B/S architecture. An arbitrary password reset vulnerability exists in the 'AdminEdit.aspx' file of the Weixia Online Learning Platform. It allows an attacker to reset the administrator password by entering a new password in...

Serendipity cross-site scripting vulnerability (CNVD-2016-00303)

Serendipity is a PHP-based blogging system. Serendipity serendipityadmin.php script fails to adequately filter the 'serendipityentryid' parameter in the 'edit' admin operation. This allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to...

GetSimple CMS suffers from multiple cross-site scripting vulnerabilities (CNVD-2015-04182)

GetSimple CMS is an XML-based content management system CMS from Cagintranet Networks, USA. The system includes a theme selector and editor, component editor, image and file managers, and more. A cross-site scripting vulnerability exists in Cagintranet Networks GetSimple CMS versions prior to...

CVE-2007-4861

SAXON 5.4, with displayerrors enabled, allows remote attackers to obtain sensitive information via 1 a direct request for news.php, 2 an invalid use of a newsid array parameter to admin/edit-item.php, and possibly unspecified vectors related to additional scripts in 3 admin/, 4 rss/, and 5 the ro...

Design/Logic Flaw

SAXON 5.4, with displayerrors enabled, allows remote attackers to obtain sensitive information via 1 a direct request for news.php, 2 an invalid use of a newsid array parameter to admin/edit-item.php, and possibly unspecified vectors related to additional scripts in 3 admin/, 4 rss/, and 5 the ro...

CVE-2007-4861

SAXON 5.4 is affected by multiple path disclosure flaws when display_errors is enabled. Exploitation vectors include direct requests to news.php, improper handling of newsid in admin/edit-item.php, and other scripts under admin/, rss/, and the installation root, which reveal server paths in error...

Authentication flaw

xGB.php in xGB 2.0 does not require authentication for an admin edit action, which allows remote attackers to make unspecified changes via an unknown series of steps...

CVE-2007-4637

CVE-2007-4637 affects xGB.php in xGB 2.0, where an admin edit action does not require authentication. This allows remote attackers to perform unspecified changes via an unknown series of steps. The NVD entry lists a MEDIUM base score (6.4) with network attack vector, low complexity, and no user i...

SimpleBlog <= 2.3 (admin/edit.asp) Remote SQL Injection Vulnerability

No description provided by source. Title : simpleblog = v 2.3 /admin/edit.asp Remote SQL Injection Vulnerability Author : bolivar Dork : "SimpleBlog 2.3 by 8pixel.net" ---------------------------------------------------------------------------...