1482 matches found
CVE-2018-18416: Improper Neutralization of Input During Web Page Generation
LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the sitename parameter to the admin/settings/update URI...
PT-2018-14447
Name of the Vulnerable Software and Affected Versions LANGO Codeigniter Multilingual Script version 1.0 Description The issue concerns a security problem where an attacker can inject malicious code. Specifically, the site name parameter in the "admin/settings/update" API endpoint is vulnerable...
CVE-2018-18209
CVE-2018-18209 affects DiliCMS 2.4.0. A reflected XSS exists via the admin/index.php/setting/site?tab=site_attachment parameter (attachment_type). Underlying issue is input handling that allows HTML/script injection, with potential exposure to sensitive data as described in CNVD-2019-17479 and CN...
Avaya Aura Orchestration Designer Runtime Config Component Cross-Site Request Forgery Vulnerability
Avaya Aura Orchestration Designer is a suite of full-featured graphical development environments from Avaya, Inc. It is used to develop applications that run on media processing servers, voice portals, and interactive response software platforms.Runtime Config is one of the runtime environment...
CVE-2018-15612
A CSRF vulnerability in the Runtime Config component of Avaya Aura Orchestration Designer could allow an attacker to add, change, or remove administrative settings. Affected versions of Avaya Aura Orchestration Designer include all versions up to 7.2.1...
PT-2018-13897 · Getsimple · Getsimple Cms
Name of the Vulnerable Software and Affected Versions: GetSimple CMS version 3.3.13 Description: An issue was discovered that allows for a CSRF vulnerability, which can change the administrator's password via the "admin/settings.php" endpoint. The vendor reported that the proof of concept was...
CVE-2018-13136
The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...
CVE-2018-13136
The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...
CVE-2018-13136: Improper Neutralization of Input During Web Page Generation
The Ultimate Member aka ultimatemember plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen...
PT-2018-11625
Name of the Vulnerable Software and Affected Versions The Ultimate Member plugin versions prior to 2.0.18 Description The issue allows for XSS via the wp-admin settings screen. Recommendations For versions prior to 2.0.18, update to version 2.0.18 or later to resolve the issue...
WordPress Plugin Form Maker 1.12.24 - SQL Injection
Title: WordPress Form Maker Plugin 1.12.24 - SQL Injection Date: 2018-06-07 Author: Neven Biruski Software: WordPress Form Maker plugin https://wordpress.org/plugins/form-maker/ Version: 1.12.24 and below Vendor Status: Vendor contacted, update released The easiest way to reproduce the SQL...
CVE-2018-11633
An issue was discovered in the MULTIDOTS Woo Checkout for Digital Goods plugin 2.1 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings. The function...
CVE-2018-11512
Stored cross-site scripting XSS vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to...
CVE-2018-11512: Improper Neutralization of Input During Web Page Generation
Stored cross-site scripting XSS vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to...
PT-2018-10629
Name of the Vulnerable Software and Affected Versions Creatiwity wityCMS version 0.6.1 Description A stored cross-site scripting XSS issue exists in the 'Website's name' field of the 'Settings' page under the 'General' menu. This allows remote attackers to inject arbitrary web script or HTML via ...
wityCMS 0.6.1 - Cross-Site Scripting
Exploit Title: wityCMS 0.6.1 Persistent XSS on "Website's name" field Date: 05/28/2018 Exploit Author: Nathu Nandwani Website: http://nandtech.co/ Vendor Homepage: https://creatiwity.net/witycms Software Link: https://github.com/Creatiwity/wityCMS/releases/tag/0.6.1 Version: 0.6.1 Tested on:...
CVE-2018-10136
iScripts UberforX 2.2 has Stored XSS in the "managesettings" section of the Admin Panel via a value field to the /cms?section=managesettings&action=edit URI...
Cross site scripting
NewsBee allows XSS via the Company Name field in the Settings under admin/admin.php...
