CVE-2018-17026

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage&name=error404 action, a different vulnerability than CVE-2018-10121...

Cross site scripting

Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages-manage under admin.php?action=files...

WESEEK GROWI cross-site scripting vulnerability (CNVD-2021-17765)

WESEEK GROWI is an open source team collaboration software developed by WESEEK Japan. The software features asset management, quick search and member management. A cross-site scripting vulnerability exists in WESEEK GROWI 3.1.11 and earlier versions. A remote attacker can exploit this vulnerabili...

CVE-2018-16363

The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wpfilemanager request because settransient is used in filefoldermanager.php and there is an echo of lang in lib\wpfilemanager.php...

CVE-2018-0655

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page...

CVE-2018-0652

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the UserGroup Management section of admin page...

Cross site scripting

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the UserGroup Management section of admin page...

Cross site scripting

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page...

CVE-2018-0655

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page...

CVE-2018-0655

GROWI: Cross-site scripting vulnerability (CVE-2018-0655) affects GROWI v3.1.11 and earlier. The flaw is in the app settings section of the admin page, allowing remote authenticated attackers to inject arbitrary script/HTML, potentially executing in a logged-in user’s browser. Remediation: update...

PT-2018-13518 · Mndpsingh287 · Wp File Manager

Name of the Vulnerable Software and Affected Versions: mndpsingh287 File Manager plugin version 2.9 Description: The issue concerns a cross-site scripting XSS problem. It occurs via the lang parameter in a "wp-admin/admin.php?page=wp file manager" request. This happens because set transient is us...

File Manager < 3.0 - Authenticated Reflected Cross-Site Scripting (XSS)

Lack of sanitisation in the lang parameter in the admin dashboard could allow attacker to perform reflected XSS attacks against logged in administrators https://example.com/wp-admin/admin.php?page=wpfilemanager&lang=zhCNalertXSS...

SQL Injection Vulnerability in the Classified Navigation System of Youk365 Website (CNVD-2018-19298)

Yuko 365 website classification navigation system is an open source navigation management system based on PHP + MYSQL development and construction. Uke365 website navigation system v1.1.3 app/admin/controller/ar.php page SQL injection vulnerability , the vulnerability stems from the system fails ...

AuraCMS Cross-Site Request Forgery Vulnerability

AuraCMS is a content management system based on PHP and MySQL. The system is characterized by simplicity and modularity. AuraCMS 2.3 version of the cross-site request forgery vulnerability , remote attackers can use admin.php?mod=users to modify the administrator password , and then add pages or...

CVE-2018-16374

Frog CMS 0.9.5 is affected by a stored cross-site scripting (XSS) vulnerability in the admin area, specifically via /admin/?/plugin/comment/settings. The issue is documented for CVE-2018-16374 and confirmed across multiple sources (NVD, CVE listings). The connected documents do not provide deeper...

CVE-2018-15849

An issue was discovered in portfolioCMS 1.0.5. There is CSRF to update the website settings via admin/aboutus.php...

CVE-2018-15842

WolfCMS 0.8.3.1 has XSS via the /?/admin/page/add slug parameter...

CVE-2018-15843

GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field...

CVE-2018-15843

GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field...

CVE-2018-15848

CVE-2018-15848 affects portfolioCMS 1.0.5. The vulnerability is a Cross-Site Request Forgery that allows a CSRF to create new pages via admin/portfolio.php?newpage=true. The issue is described with a CVSS2 base score of 6.8 (MEDIUM) and CVSS3 base score of 8.8 (HIGH) indicating network-accessible...