755 matches found
PT-2021-10142
Name of the Vulnerable Software and Affected Versions: MetInfo version 6.1.3 Description: A Cross Site Request Forgery CSRF issue exists, which can be exploited via a doaddsave action in the admin/index.php API endpoint. This allows for unauthorized actions to be performed on behalf of a user...
CVE-2020-18157: Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery CSRF vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php...
CVE-2020-23697
Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php...
PT-2021-10928
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue is related to a Cross Site Scripting vulnerability in the page feature of admin/index.php. This vulnerability can be exploited via the page feature. Recommendations For Monstra CMS version 3.0.4,...
CVE-2020-23697: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php...
CVE-2020-18648: Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery CSRF in JuQingCMS v1.0 allows remote attackers to gain local privileges via the component "JuQingCMSv1.0/admin/index.php?c=administrator&a=add"...
PT-2021-3633
Name of the Vulnerable Software and Affected Versions Hongcms versions 4.0.0 Description The issue is related to a path traversal vulnerability in the /hcms/admin/index.php/language/ajax component of the Hongcms content management system. This vulnerability can be exploited by a remote attacker t...
CVE-2020-18178: Improper Limitation of a Pathname to a Restricted Directory
Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax."...
CVE-2020-21590
Directory traversal in coreframe/app/template/admin/index.php in WUZHI CMS 4.1.0 allows attackers to list files in arbitrary directories via the dir parameter...
PT-2021-10645
Name of the Vulnerable Software and Affected Versions: WUZHI CMS version 4.1.0 Description: The issue allows attackers to list files in arbitrary directories via the dir parameter in the coreframe/app/template/admin/index.php file. This is a directory traversal issue that can be exploited by...
CVE-2020-21590: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal in coreframe/app/template/admin/index.php in WUZHI CMS 4.1.0 allows attackers to list files in arbitrary directories via the dir parameter...
PT-2021-18034
Name of the Vulnerable Software and Affected Versions: Bitweaver version 3.1.0 Description: A cross-site scripting XSS issue allows remote attackers to inject JavaScript via the "/users/admin/index.php" API endpoint. This enables attackers to execute malicious scripts on the client-side...
CVE-2021-29030: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/index.php URI...
CVE-2020-35709
bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...
PT-2020-17398
Name of the Vulnerable Software and Affected Versions bloofoxCMS version 0.5.2.1 Description The issue allows admins to upload arbitrary .php files to ../media/images/ via the "admin/index.php?mode=tools&page=upload" URI, which is a directory traversal issue. This is achieved by using a...
CVE-2020-35709: Improper Limitation of a Pathname to a Restricted Directory
bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...
PT-2020-16879
Name of the Vulnerable Software and Affected Versions SourceCodester Car Rental Management System version 1.0 Description The issue allows remote code execution due to an arbitrary file upload vulnerability in the Upload Image component. This is possible because .php files can be uploaded to the...
CVE-2020-27956: Unrestricted Upload of File with Dangerous Type
An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the user to conduct remote code execution via admin/index.php?page=managecar because .php files can be uploaded to admin/assets/uploads/ under the web root...
CVE-2020-23839
A Reflected Cross-Site Scripting XSS vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the logi...
CVE-2020-23839: Improper Neutralization of Input During Web Page Generation
A Reflected Cross-Site Scripting XSS vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the logi...