PT-2018-14407 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.480 Description: The issue concerns a Cross-Site Scripting XSS problem. It affects the fm current dir parameter in the "admin/fileManager2.php" endpoint, as well as the module, service start, service fullstatus,...

CVE-2018-18201

qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account...

CVE-2018-17884

XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook gwolle-gb plugin before 2.5.4 for WordPress via the PATHINFO to wp-admin/index.php...

Monstra CMS Arbitrary File Deletion Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A security vulnerability exists in the admin/index.php file in Monstra CMS version 3.0.4. An attacker can...

Monstra CMS Directory Traversal Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A directory traversal vulnerability exists in the admin/index.php file in Monstra CMS version 3.0.4. An...

Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2019-03473)

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in the admin/index.php file in Monstra CMS version 3.0.4, which c...

CVE-2018-16774

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete...

CVE-2018-14420

MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=adminadmin&a=doaddsave URI...

CVE-2018-13999

Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter aka an article posted by an administrator...

CVE-2018-13999

Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter aka an article posted by an administrator...

CVE-2017-17645

Bus Booking Script 1.0 has SQL Injection via the txtname parameter to admin/index.php...

CVE-2017-9759

SQL Injection exists in admin/index.php in Zenbership 1.0.8 via the filters array parameter, exploitable by a privileged account...

CVE-2017-8897

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. This UTF8 Converter vulnerability can easily be used to make a malicious announcement affecting any Invision...

SQL injection vulnerability in mallbuilder background admin/index.php page

MallBuilder is a multi-user online shopping mall solution system based on PHP+MYSQL. A SQL injection vulnerability exists in the admin/index.php page of the mallbuilder backend, which allows attackers to exploit the vulnerability to obtain sensitive database information...

EUVD-2015-1559

Multiple cross-site scripting XSS vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 horder, 2 jakcatid, 3 jakcontent, 4 jakcss, 5 jakdeletelog, 6 jakemail, 7 jakextfile, 8 jakfile, 9 jakhookshow, 10 jakimg, 11 jakjavascript, 12...

CVE-2012-5700

Multiple cross-site scripting XSS vulnerabilities in Baby Gekko before 1.2.2f allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to admin/index.php or the 2 username or 3 password parameter in blocks/loginbox/loginbox.template.php to index.php. NOTE: some of thes...

AnotherPHPBook (APB) 1.3.0 (Auth Bypass) - SQL Injection Vulnerability

No description provided by source. APBook 1.3.0 Login Bypass SQL Injection Vulnerability AUTHOR: n3w7u Download: www.clanscripte.net/main.php?content=download&do=dl&dlid=81 Dorks: inurl:apbook/index.php or AnotherPHPBook APB v.1.3.0 © 2001 by Stephan Baumeister zap Exploit:...

VicBlog Path Disclosure / SQL Injection

Author : Geek Title : Vicblog Multiple Vulnerabilities Date : 10/25/2012 Dork : allintext: "Powered by VicBlog" Tested On : Winxp Multiple Sql Injection x File : passwordforgotten x Code : $email = $POST'email' ; $sql = mysqlquery"SELECT FROM vbaccounts where email = '$email'" x P0c :...

CVE-2012-5228

Cross-site scripting XSS vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter. NOTE: some of these details are obtained from third party information...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Pligg CMS before 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 user or 2 page parameter to a admin/admincomments.php or b admin/adminlinks.php; or list parameter in a 3 move or 4 minimize action to c...