5126 matches found
Cross site request forgery (csrf)
iScripts UberforX 2.2 has CSRF in the "managesettings" section of the Admin Panel via the /cms?section=managesettings&action=edit URI...
Cross site scripting
iScripts UberforX 2.2 has Stored XSS in the "managesettings" section of the Admin Panel via a value field to the /cms?section=managesettings&action=edit URI...
CVE-2018-10136
iScripts UberforX 2.2 has Stored XSS in the "managesettings" section of the Admin Panel via a value field to the /cms?section=managesettings&action=edit URI...
CVE-2018-10137
iScripts UberforX 2.2 has CSRF in the "managesettings" section of the Admin Panel via the /cms?section=managesettings&action=edit URI...
CVE-2018-10136
Vulnerability summary (CVE-2018-10136): iScripts UberforX 2.2 contains a Stored XSS in the Admin Panel under the “manage_settings” page, exploitable by injecting script via the value field in the URI /cms?section=manage_settings&action=edit. The Red Hat and CNVD entries corroborate the same issue...
CVE-2018-10136
iScripts UberforX 2.2 has Stored XSS in the "managesettings" section of the Admin Panel via a value field to the /cms?section=managesettings&action=edit URI...
CVE-2018-10137
iScripts UberforX 2.2 has CSRF in the "managesettings" section of the Admin Panel via the /cms?section=managesettings&action=edit URI...
CVE-2018-10137
CSRF in iScripts UberforX 2.2 Admin Panel: the issue is in the manage_settings section exposed at /cms?section=manage_settings&action=edit. CVSS3 base score 8.8 (HIGH); attack vector NETWORK, user interaction REQUIRED, impacts on C/I/A HIGH. No exploitation details are provided in the documents; ...
CVE-2018-10121
plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the title section of an admin/index.php?id=pages&action=editpage&name=error404 aka Edit 404 page action...
CVE-2018-10121
plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the title section of an admin/index.php?id=pages&action=editpage&name=error404 aka Edit 404 page action...
CVE-2018-10083
CMS Made Simple CMSMS through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter...
iScripts eSwap SQL Injection Vulnerability
IScripts eSwap is an item trading program from IScripts Inc. that supports the use of virtual currency or direct item exchange. The program supports the use of virtual currencies to trade or directly exchange items.User Panel is one of the user panels. A SQL injection vulnerability exists in...
iScripts eSwap registration_settings.php cross-site scripting vulnerability
IScripts eSwap is an item trading software from IScripts Inc. The program supports the use of virtual currencies for trading or direct item exchange.User Panel is one of the user panels. A cross-site scripting vulnerability exists in iScripts eSwap v2.4. The vulnerability can be exploited via the...
Mail.ru: 3rd party shop admin panel blind XSS
Blind XSS in third party shop's admin panel. This host and company is not operated or owned by Mail.Ru Group, but it runs an online shop and processes orders for Mail.Ru branded gift shop. It does not have any privileged/additional access to Mail.Ru network or user's data. Gift shop is not...
Design/Logic Flaw
iScripts eSwap v2.4 has XSS via the "registrationsettings.php" txtDate parameter in the Admin Panel...
CVE-2018-10048
iScripts eSwap v2.4 has CSRF via "registrationsettings.php" in the Admin Panel...
Sql injection
iScripts eSwap v2.4 has SQL injection via the "registrationsettings.php" ddlFree parameter in the Admin Panel...
CVE-2018-10048
iScripts eSwap v2.4 has CSRF via "registrationsettings.php" in the Admin Panel...