Interchange Cross-Site Scripting Vulnerability

Interchange is an e-commerce system. The system supports online ordering, real-time payment processing, product categorization and customer relationship management. A cross-site scripting vulnerability exists in the admin/help.html and admin/quicklinks.html pages of the admin help system in...

WP-Advanced-Search < 3.3.7 - Authenticated SQL Injection

The import functionality to restore plugin settings within the admin pages was vulnerable to SQL Injection through a privileged user with the editposts capability...

Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-18332)

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflective cross-site scripting vulnerability exists in admin/manage-departments.php in Chadha PHPKB Standard Multi-Language 9. Th...

Security Bulletin: Cacheable HTTPS Responses have been identified on multiple Tivoli Netcool/OMNIbus WebGUI admin pages (CVE-2020-4197)

Summary Fix is available for vulnerability Cacheable HTTPS Responses in Tivoli Netcool/OMNIbus WebGUI admin pages CVE-2020-4197. Vulnerability Details CVEID: CVE-2020-4197 DESCRIPTION: IBM Tivoli Netcool/OMNIbusGUI allows web pages to be stored locally which can be read by another user on the...

CVE-2020-7994

Multiple cross-site scripting XSS vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 labellibelle parameter to the /htdocs/admin/dict.php?id=3 page; the 2 nameconstname parameter to the /htdocs/admin/const.php?mainmenu=home page; the 3...

CVE-2020-7994

Multiple cross-site scripting XSS vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 labellibelle parameter to the /htdocs/admin/dict.php?id=3 page; the 2 nameconstname parameter to the /htdocs/admin/const.php?mainmenu=home page; the 3...

PT-2020-19905 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 10.0.6 Description: Multiple cross-site scripting XSS vulnerabilities allow remote attackers to inject arbitrary web script or HTML via various parameters to different pages, including the labellibelle parameter to the...

Cross-Site Request Forgery (CSRF)

wordpress is vulnerable to cross-site request forgery CSRF. An improper validation of the referer in the admin pages can potentially result in a type confusion which can lead to a successful CSRF attack...

DEBIAN-CVE-2019-17675

WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF...

Type confusion

WordPress before 5.2.4 does not properly consider type confusion during validation of the referer in the admin pages, possibly leading to CSRF...

CVE-2019-12516

The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= or /wp-admin/admin.php?page=slickquiz-edit&id= or /wp-admin/admin.php?page=slickquiz-preview&id= URI...

PT-2019-5221 · WordPress · Wordpress

Name of the Vulnerable Software and Affected Versions: WordPress versions prior to 5.2.4 Description: The issue is related to a type confusion error during referer validation on admin pages, which could lead to a CSRF attack. This might allow a remote attacker to access confidential data,...

CVE-2017-18519

The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages...

CVE-2017-18519

The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages...

Design/Logic Flaw

The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages...

CVE-2017-18519

The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages...

CVE-2017-18519

CVE-2017-18519 affects the WordPress plugin customer-area prior to version 7.4.3, with XSS via admin pages. Root cause: improper sanitization in admin interfaces. Impact: XSS could be triggered from the admin area; remediation: upgrade to 7.4.3 or later.

CVE-2019-11398

Multiple cross-site scripting XSS vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon...

Cross site scripting

WeBid 1.2.2 has reflected XSS via the id parameter to admin/deletenews.php, admin/editbannersuser.php, admin/editfaqscategory.php, or admin/excludeuser.php, or the offset parameter to admin/edituser.php...

Vulnerabilities in the web interface of the Cisco Identity Services Engine, a platform for managing network policies, allow attackers to gain access to protected information.

The vulnerability in the web interface of the Cisco Identity Services Engine management platform relates to insufficient protection of saved passwords when configuring pages on the administrator portal. Exploiting this vulnerability can allow a malicious actor to gain access to protected...