2398 matches found
CVE-2018-10318
Frog CMS 0.9.5 has XSS via the admin/?/page/edit pagekeywords parameter, aka Edit Page Metadata...
CVE-2018-10318
Frog CMS 0.9.5 contains a cross-site scripting (XSS) vulnerability in the admin/?/page/edit page[keywords] parameter (Edit Page Metadata). The issue arises from user-supplied content in the keywords field that is reflected in the page. Exploitation specifics beyond this description are not provid...
CVE-2018-10318
Frog CMS 0.9.5 has XSS via the admin/?/page/edit pagekeywords parameter, aka Edit Page Metadata...
ChemCMS Cross-Site Request Forgery Vulnerability
ChemCMS is a chemical-based web content management system CMS based on PHP and MySQL. A cross-site request forgery vulnerability exists in ChemCMS version 1.0.6. A remote attacker can exploit this vulnerability to add an administrator account via the public/admin/user/addpost.html page...
Frog CMS Cross-Site Scripting Vulnerability (CNVD-2018-08556)
Frog CMS is a content management system CMS developed by software developer Philippe Archambault. The system provides tools for page templates, user rights management, and document management. A cross-site scripting vulnerability exists in Frog CMS version 0.9.5. A remote attacker can exploit the...
CVE-2018-10234
Authenticated Cross site Scripting exists in the User Profile & Membership plugin before 2.0.11 for WordPress via the "Account Deletion Custom Text" input field on the wp-admin/admin.php?page=umoptions§ion=account page...
CVE-2018-10223
An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/adminmanage/add.html...
Frog CMS Cross-Site Request Forgery Vulnerability
Frog CMS is a content management system CMS developed by software developer Philippe Archambault. The system provides tools for page templates, user rights management, and document management. In Frog CMS version 0.9.5, a /admin/? /user/add is vulnerable to cross-site request forgery. A remote...
Cross site scripting
plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the title section of an admin/index.php?id=pages&action=editpage&name=error404 aka Edit 404 page action...
Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2018-08254)
Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A cross-site scripting vulnerability exists in Monstra CMS version 3.0.4. A remote attacker can exploit the...
Design/Logic Flaw
YUNUCMS 1.0.7 has XSS via the content title on an admin/content/addcontent/cid/ page aka a news center page...
YUNUCMS \app\admin\controller\Common.php page has secondary injection vulnerability
YUNUCMS enterprise website management system YUNUCMS is a set of professional marketing enterprise building system based on PHP + MYSQL as the core development. YUNUCMS V1.0.7 \app\admin\controller\Common.php page has a secondary injection vulnerability. An attacker can exploit the vulnerability ...
Xiuno BBS Cross-Site Scripting Vulnerability
Xiuno BBS is an open source lightweight forum system. A cross-site scripting vulnerability exists in the 'sitename' parameter of the admin page in Xiuno BBS version 4.0.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
WordPress WP HTML Sitemap plugin cross-site request forgery vulnerability
WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.WP HTML Sitemap plugin is used in one of the by entering a short code in the page to add HTML sitemap plugin. A...
CVE-2018-8832
enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page...
CVE-2018-8832
enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page...
CVE-2018-8832
enhavo 0.4.0 (PHP Symfony-based CMS) has a cross-site scripting vulnerability where a user-group name can contain executable JavaScript. The attack triggers when a victim visits the admin user group page, indicating that the vulnerable input is not properly sanitized on that page. The available s...
CVE-2018-8832
enhavo 0.4.0 has XSS via a user-group that contains executable JavaScript code in the user-group name. The XSS attack launches when a victim visits the admin user group page...
CVE-2018-6883
Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator...
Custom Permalinks <= 1.1 - Cross-Site Scripting (XSS)
User controllable input in the admin page of Custom Permalinks gets output without any escaping. PoC URL/wp-admin/admin.php?page=custom-permalinks-post-permalinks=...