2398 matches found
CVE-2019-17417
PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs...
CVE-2019-17418
An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=language&c=languagegeneral&a=doSearchParameter appno parameter, a different issue than CVE-2019-16997...
CVE-2015-9428
The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters...
CVE-2019-16703
admin/infolistadd.php in PHPMyWind 5.6 has stored XSS...
CVE-2015-9399
The wp-stats-dashboard plugin through 2.9.4 for WordPress has admin/graphtrend.php type SQL injection...
CVE-2019-16399
Western Digital WD My Book World through II 1.02.12 suffers from Broken Authentication, which allows an attacker to access the /admin/ directory without credentials. An attacker can easily enable SSH from /admin/systemadvanced.php?lang=en and login with the default root password welc0me...
CVE-2016-10989
The leenkme plugin before 2.6.0 for WordPress has wp-admin/admin.php?page=leenkmefacebook CSRF...
CVE-2016-10992
The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports fromyear parameter...
CVE-2016-10992
The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports fromyear parameter...
Piwigo Cross-Site Scripting Vulnerability (CNVD-2019-32000)
Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time and more. A cross-site scripting vulnerability exists in admin.php?page=notificationbymail in Piwigo version 2.9.5. The vulnerabili...
CVE-2019-13363
admin.php?page=notificationbymail in Piwigo 2.9.5 has XSS via the nbmsendhtmlmail, nbmsendmailas, nbmsenddetailedcontent, nbmcomplementarymailcontent, nbmsendrecentpostdates, or paramsubmit parameter. This is exploitable via CSRF...
CVE-2016-10952
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter...
CVE-2017-18613
The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter...
CVE-2017-18602
The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examappUserResult id parameter...
CVE-2017-18602
The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examappUserResult id parameter...
GitLab: Stored XSS for Grafana dashboard URL
Hi GitLab Security Team Summary I found a stored XSS vulnerability in the admins page. The administrator can set up a Grafana dashboard. Here, the administrator can either enter a relative URL or an absolute address. However, when adding an absolute URL, the protocol is not checked allowing to ad...
CVE-2019-14789
The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter...
PT-2019-13834 · WordPress · Custom 404 Pro
Name of the Vulnerable Software and Affected Versions: Custom 404 Pro plugin version 3.2.8 Description: The issue concerns a problem with the Custom 404 Pro plugin for WordPress, where there is an XSS issue via the "page" parameter in the wp-admin/admin.php page. Recommendations: For Custom 404 P...