755 matches found
Cross site request forgery (csrf)
An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI...
CVE-2018-10265: Cross-Site Request Forgery (CSRF)
An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI...
PT-2018-9795
Name of the Vulnerable Software and Affected Versions: HongCMS version 3.0.0 Description: An issue was discovered that allows for a CSRF vulnerability, enabling the addition of an administrator account via the "admin/index.php/users/save" URI. Recommendations: For HongCMS version 3.0.0, update to...
Cross site scripting
Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php...
CVE-2018-10118
Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php...
CVE-2018-10118
Monstra CMS 3.0.4 is affected by a Stored XSS in the Name field on the Create New Page screen (admin/index.php?id=pages), related to plugins/box/pages/pages.admin.php. This CVE details the vulnerable component path and the input point that leads to script execution. The connected data confirms th...
CVE-2018-10118: Improper Neutralization of Input During Web Page Generation
Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php...
PT-2018-9693
Name of the Vulnerable Software and Affected Versions: Monstra CMS version 3.0.4 Description: The issue concerns a stored XSS vulnerability. An attacker with access to the editor role can exploit this by entering a malicious payload in the title section of the "Edit 404 page" action, which is...
PT-2018-9692
Name of the Vulnerable Software and Affected Versions: Monstra CMS version 3.0.4 Description: The issue is related to a Stored XSS in the Name field on the Create New Page screen, accessible under the "admin/index.php?id=pages" URI, and is associated with the plugins/box/pages/pages.admin.php fil...
afmec.org XSS vulnerability
Open Bug Bounty ID: OBB-600205 Description| Value ---|--- Affected Website:| afmec.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
PT-2018-18800
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue allows remote attackers to delete files. This can be achieved by sending a request to the "admin/index.php" endpoint with specific parameters, including id set to "filesmanager", delete dir set t...
Design/Logic Flaw
Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...
CVE-2018-6550
Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...
CVE-2018-6550: Improper Neutralization of Input During Web Page Generation
Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php...
PT-2018-17629
Name of the Vulnerable Software and Affected Versions Monstra CMS versions prior to 3.0.5 Description The issue concerns a problem with the title function in the pages.plugin.php file within the plugins/box/pages directory. This problem allows for XSS attacks when a page title is sent to...
CVE-2017-17645
Bus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php...
CVE-2017-17645
CVE-2017-17645 affects Bus Booking Script 1.0. The vulnerability is a SQL Injection via the txtname parameter in admin/index.php, caused by unsanitized input in a PHP/MySQL-based web app. Public references (NVD, CNVD, CVE records) describe SQL injection as the issue, with in-the-wild PoCs/exploit...
CVE-2017-17645: Improper Neutralization of Special Elements used in an SQL Command
Bus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php...
PT-2017-14940
Name of the Vulnerable Software and Affected Versions Bus Booking Script version 1.0 Description The issue is related to SQL Injection, which occurs via the txtname parameter to the "admin/index.php" endpoint. This allows for potential exploitation. Recommendations For Bus Booking Script version...