2398 matches found
CVE-2021-20724
CVE-2021-20724 affects Telop01 free edition (ver 1.0.1 and earlier). The admin page is vulnerable to reflected cross-site scripting due to insufficient sanitization of user-supplied data in admin pages. The vulnerability allows a remote attacker to inject arbitrary script, executed in the victim’...
Multiple cross-site scripting vulnerabilities in multiple PHP Factory products
Overview Multiple products provided by PHP Factory contain multiple cross-site scripting vulnerabilities listed below. Reflected cross-site scripting vulnerability CWE-79 - CVE-2021-20723 Reflected cross-site scripting vulnerability in the admin page CWE-79 - CVE-2021-20724 Reflected cross-site...
PHP Factory Telop01 跨站脚本漏洞
php factory Telop01 is a simple PHP program from Japan's PHP Factory that displays subtitles, news tickers and headlines in flowing characters on the home page and any page. A security vulnerability exists in Telop01 1.0.1, which stems from insufficient sanitization of user-supplied data in the...
CVE-2021-29045
Cross-site scripting XSS vulnerability in the Redirect module's redirection administration page in Liferay Portal 7.3.2 through 7.3.5, and Liferay DXP 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the...
Pluck 跨站请求伪造漏洞
Pluck is a content management system CMS developed using the PHP language. A cross-site request forgery vulnerability exists in Pluck CMS version 4.7.9. A remote attacker can exploit this vulnerability to execute arbitrary code and delete specific articles via the component "/admin.php?action=pag...
CVE-2020-18165
Cross Site Scripting XSS in LAOBANCMS v2.0 allows remote attackers to execute arbitrary code by injecting commands into the "Website SEO Keywords" field on the page "admin/info.php?shuyu"...
CVE-2020-13873
A SQL Injection vulnerability in gettopicinfo in sys/CODOF/Forum/Topic.php in Codoforum before 4.9 allows remote attackers pre-authentication to bypass the admin page via a leaked password-reset token of the admin. As an admin, an attacker can upload a PHP shell and execute remote code on the...
Sql injection
A SQL Injection vulnerability in gettopicinfo in sys/CODOF/Forum/Topic.php in Codoforum before 4.9 allows remote attackers pre-authentication to bypass the admin page via a leaked password-reset token of the admin. As an admin, an attacker can upload a PHP shell and execute remote code on the...
LAOBANCMS 跨站脚本漏洞
LAOBANCMS is a content management system based on PHP and MySQL. A cross-site scripting vulnerability exists in LAOBANCMS version 2.0. An attacker can execute arbitrary code by injecting commands into the "Website SEO Keywords" field on the "admin/info.php?shuyu" page...
Liferay Enterprise Portal 跨站脚本漏洞
Liferay Enterprise Portal is an application system from Liferay USA. It provides a showcase for e-commerce functionality. A cross-site scripting vulnerability exists in Liferay Enterprise Portal. The vulnerability stems from insufficient handling of user-supplied data in the administration page o...
Cross site scripting
Cross-site scripting XSS vulnerability in admin/nav/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in admin/article/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter...
CVE-2021-32103
A Stored XSS vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web script or HTML via the lname parameter...
CVE-2021-31737
emlog v5.3.1 and emlog v6.0.0 have a Remote Code Execution vulnerability due to upload of database backup file in admin/data.php...
CVE-2020-18020
SQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by injecting SQL commands into the "userphone" parameter of a crafted HTTP request to the "admin.php" component...
Popup by Supsystic < 1.10.5 - Reflected Cross-Site scripting (XSS)
The plugin did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue /wp-admin/admin.php?page=popup-wp-supsystic&tab="onmouseover=alert1//...
Ultimate Maps by Supsystic < 1.2.5 - Reflected Cross-Site scripting (XSS)
The plugin did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue /wp-admin/admin.php?page=ultimate-maps-supsystic&tab="onmouseover=alert1//...
Acronis: Store Admin Page Accessible Without Authentication at http://www.grouplogic.com/ADMIN/store/index.cfm
Summary The store admin page is accessible without authentication at below URL: http://www.grouplogic.com/ADMIN/store/index.cfm The store admin page provides functionalities such as the following: - Add Edit Items - Search Products - Search Results - Search Orders - Orders Search Results - Add Ne...
Event Banner <= 1.3 - Arbitrary File Upload to RCE
The plugin does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, such as .exe, .php, or others executable, leading to RCE. Due to the lack of CSRF check, the issue can also be used via such vector to achieve the same result, or via a LFI as authorisation chec...