Design/Logic Flaw

MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abttype parameter...

CVE-2018-18832

admin/check.asp in DKCMS 9.4 allows SQL Injection via an ASPSESSIONID cookie to admin/admin.asp...

CVE-2018-18739

An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMSProducts.php?lgid=1 Keywords field...

CVE-2018-18738

An XSS issue was discovered in SEMCMS 3.4 via the admin/SEMCMSCategories.php?pid=1&lgid=1 categorykey parameter...

CVE-2018-18721

An XSS issue was discovered in admin/link/editlink?id=5 in YUNUCMS 1.1.5...

DESTOON B2B Cross-Site Request Forgery Vulnerability

DESTOON B2B is a PHP and MySQL based open source B2B e-commerce website management system . A cross-site request forgery vulnerability exists in DESTOON B2B version 7.0. A remote attacker can exploit this vulnerability by using the admin.php URI in the action=add request to perform unauthorized...

DESTOON B2B Cross-Site Scripting Vulnerability

DESTOON B2B is a PHP and MySQL based on open source B2B e-commerce website management system . A cross-site scripting vulnerability exists in the admin\setting.inc.php page in DESTOON B2B version 7.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the...

CVE-2018-18433

An issue was discovered in DESTOON B2B 7.0. admin/category.inc.php has XSS via the categorycatname parameter to the admin.php URI...

Cross site scripting

XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter...

CVE-2018-18374

XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter...

CVE-2018-18374

XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter...

CVE-2018-18259

Stored XSS has been discovered in version 1.0.12 of the LUYA CMS software via /admin/api-cms-nav/create-page...

CVE-2018-18259

Stored XSS has been discovered in version 1.0.12 of the LUYA CMS software via /admin/api-cms-nav/create-page...

CVE-2018-18271

XSS exists in CMS Made Simple version 2.2.7 via the m1extra parameter in an admin/moduleinterface.php "Content--News--Add Article" action...

CVE-2018-18191

Cross-site request forgery CSRF vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password...

CVE-2018-17884

XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook gwolle-gb plugin before 2.5.4 for WordPress via the PATHINFO to wp-admin/index.php...

Arbitrary file deletion

admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&deletefile= requests...

CVE-2018-17140

The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a qlinsert action to wp-admin/admin.php...

CVE-2018-17086

An issue was discovered in OTCMS 3.61. XSS exists in admin/shareswitch.php via these parameters: fieldName fieldName2 tabName...

CVE-2018-17086

An issue was discovered in OTCMS 3.61. XSS exists in admin/shareswitch.php via these parameters: fieldName fieldName2 tabName...