CVE-2018-18790

An issue was discovered in zzcms 8.3. SQL Injection exists in admin/specialadd.php via a zxbigclassid cookie. This needs an admin user login...

CVE-2018-18788

An issue was discovered in zzcms 8.3. SQL Injection exists in admin/classmanage.php via the tablename parameter. This needs an admin user login...

CVE-2018-18784: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in zzcms 8.3. SQL Injection exists in admin/tagmanage.php via the tabletag parameter. This needs an admin user login...

PT-2018-14648

Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description An issue exists in the software where SQL Injection is possible. This occurs in the admin/tagmanage.php file through the tabletag parameter, and it requires an admin user to be logged in. Recommendations For zzcms...

CVE-2018-18788: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in zzcms 8.3. SQL Injection exists in admin/classmanage.php via the tablename parameter. This needs an admin user login...

PT-2018-14654

Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description An issue exists in the software where SQL Injection is possible. This occurs in the admin/special add.php endpoint via the zxbigclassid cookie, and it requires an admin user to be logged in. Recommendations For...

PT-2018-14652

Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description An issue exists in the software, where SQL Injection is possible in the admin/classmanage.php file via the tablename parameter. This issue requires an admin user to be logged in. Recommendations For zzcms version...

CVE-2018-18790: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in zzcms 8.3. SQL Injection exists in admin/specialadd.php via a zxbigclassid cookie. This needs an admin user login...

CVE-2018-18486

An issue was discovered in PHPSHE 1.7. SQL injection exists via the admin.php?mod=user&act=del userid parameter...

PHP-SHOP Master 1.0 Cross Site Request Forgery

Exploit Title: PHP-SHOP master 1.0 - Cross-Site Request Forgery Add admin Exploit Author : Alireza Norkazemi Date: 2018-10-15 Vendor Homepage : https://github.com/joeyrush/PHP-SHOP Software link: https://github.com/joeyrush/PHP-SHOP/archive/master.zip Version: 1.0 Tested on: Windows 10 CVE: N/A...

Users on IOS devices can not log into XenApp after upgrading to Citrix Workspace app for iOS, authentication broken in 17.08

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Users on Ipad IOS devices can no longer log into XenApp after upgrading Citrix Receiver to Citrix...

Academic Timetable Final Build 7.0b - Cross-Site Request Forgery (Add Admin)

Academic Timetable Final Build 7.0b - Cross-Site Request Forgery Add Admin Exploit Title: Academic Timetable Final Build 7.0b - Cross-Site Request Forgery Add Admin Dork: N/A Date: 2018-10-13 Exploit Author: Ihsan Sencan Vendor Homepage: http://geoffpartridge.net/ Software Link:...

Storage-type cross-site scripting vulnerability at the front-end posting message of PawnBuilder CMS

SmallBuild CMS is a website management backend based on the OneThink open source framework. A stored cross-site scripting vulnerability exists in the front-end posting message of PawnBuilder CMS. Attackers by building a CSRF add administrator user can insert malicious js code in the page to obtai...

CVE-2018-17986

rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user...

CVE-2018-17986: Cross-Site Request Forgery (CSRF)

rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user...

CVE-2018-17986

CVE-2018-17986 affects razorCMS 3.4.8. The vulnerability is a Cross-Site Request Forgery (CSRF) in the rars/user/data page that allows changing the password of an admin user. No exploitation details are provided in the connected documents. Impact is described by multiple sources as enabling passw...

CVE-2018-17986

rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user...

CVE-2018-17826

HisiPHP 1.0.8 is vulnerable to CSRF via admin.php/admin/user/adduser.html, enabling an attacker to create an administrator account. This account can then leverage app/common/model/AdminAnnex.php to add .php to the allowed file-upload types list (.jpg, .png, .gif, .jpeg, .ico), facilitating arbitr...

PT-2018-14206

Name of the Vulnerable Software and Affected Versions HisiPHP version 1.0.8 Description The issue allows for a CSRF attack via the "admin.php/admin/user/adduser.html" API endpoint to add an administrator account. An attacker can then use this account to execute arbitrary PHP code by modifying the...

CVE-2018-17826: Cross-Site Request Forgery (CSRF)

HisiPHP 1.0.8 allows CSRF via admin.php/admin/user/adduser.html to add an administrator account. The attacker can then use that account to execute arbitrary PHP code by leveraging app/common/model/AdminAnnex.php to add .php to the default list of allowable file-upload types .jpg, .png, .gif, .jpe...