575 matches found
CVE-2021-41654: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php...
NukeViet Cross-Site Request Forgery (CSRF)
clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...
CVE-2022-28523: Improper Limitation of a Pathname to a Restricted Directory
HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete...
CVE-2022-27346: Unrestricted Upload of File with Dangerous Type
Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2022-27436: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in /public/admin/index.php?adduser at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username text field...
CVE-2021-44610
Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 URLs, 2 langid, 3 tmplid, 4 modrewrite 5 etadoctype. 6 metacharset, 7 defaultgroup, and 8 page group parameters in the settings mode in admin/index.php...
Sql injection
Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 URLs, 2 langid, 3 tmplid, 4 modrewrite 5 etadoctype. 6 metacharset, 7 defaultgroup, and 8 page group parameters in the settings mode in admin/index.php...
CVE-2021-44610: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL Injection vulnerabilities exist in bloofoxCMS 0.5.2.1 - 0.5.1 via the 1 URLs, 2 langid, 3 tmplid, 4 modrewrite 5 etadoctype. 6 metacharset, 7 defaultgroup, and 8 page group parameters in the settings mode in admin/index.php...
CVE-2020-20946
CVE-2020-20946 affects Qibosoft v7 (CMS) with a stored XSS vulnerability in the admin path /admin/index.php?lfj=friendlink&action=add. The root cause is input data not validated in the friendlink/add handler, enabling injected client-side script execution. CVSS metrics indicate a Low to Medium ov...
CVE-2020-20946: Improper Neutralization of Input During Web Page Generation
Qibosoft v7 contains a stored cross-site scripting XSS vulnerability in the component /admin/index.php?lfj=friendlink&action=add...
CVE-2020-20944: Improper Limitation of a Pathname to a Restricted Directory
An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files...
CVE-2020-20945: Cross-Site Request Forgery (CSRF)
A Cross-Site Request Forgery CSRF in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add administrator accounts...
CVE-2021-36548: Unrestricted Upload of File with Dangerous Type
A remote code execution RCE vulnerability in the component /admin/index.php?id=themes&action=edittemplate&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary commands via a crafted PHP file...
CVE-2020-28145: Exposure of Resource to Wrong Sphere
Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitive information...
CVE-2020-21431: Undefined Security Weakness
HongCMS v3.0 contains an arbitrary file read and write vulnerability in the component /admin/index.php/template/edit...
CVE-2020-20124
Wuzhi CMS v4.1.0 contains a remote code execution RCE vulnerability in \attachment\admin\index.php...
CVE-2020-20124: Improper Control of Generation of Code
Wuzhi CMS v4.1.0 contains a remote code execution RCE vulnerability in \attachment\admin\index.php...
CVE-2021-40674: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability exists in Wuzhi CMS v4.1.0 via the KeyValue parameter in coreframe/app/order/admin/index.php...
WUZHI CMS SQL Injection Vulnerability (CNVD-2021-99300)
WUZHI CMS Five Fingers CMS is a high-performance open source content management system that supports LNAMP architecture, suitable for portals, enterprise websites, mobile sites, microsoft promotion. Attackers can use the keywords parameter in coreframe/app/promote/admin/index.php vulnerability fo...