57 matches found
CVE-2019-17553
An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags&c=index&a=doSaveTags URI...
Cross site scripting
PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs...
CVE-2019-16310
NIUSHOP V1.11 has XSS via the index.php?s=/admin URI...
CVE-2019-16310
NIUSHOP V1.11 has XSS via the index.php?s=/admin URI...
CVE-2019-16310
CVE-2019-16310 affects NIUSHOP V1.11 with an XSS vulnerability via the index.php?s=/admin URI. The connected records do not provide payloads, affected sub-versions beyond V1.11, remediation steps, or explicit exploit details. CVSS metrics are provided (NVD CVSSv2 base 3.5, CVSSv3.1 base 5.4). Act...
CVE-2019-16310
NIUSHOP V1.11 has XSS via the index.php?s=/admin URI...
CVE-2019-12449
The CVE-2019-12449 entry affects GNOME gvfs (1.29.4–1.41.2) in the gvfs backend admin code. The issue is that during move (and copy with G_FILE_COPY_ALL_METADATA) from admin:// to file:// URIs, the gvfsbackendadmin.c path mishandles a file’s user and group ownership because root privileges are un...
CVE-2019-11375
Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI...
Design/Logic Flaw
Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI...
CVE-2019-11375
Msvod v10 has a CSRF vulnerability to change user information via the admin/member/edit.html URI...
CVE-2019-9613
An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadVideo URI...
CVE-2019-9617
An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider for example file.jsp::$DATA to the admin/ueditor/uploadFile URI...
CVE-2019-9049
An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete modules via a /admin.php?action=moduledelete&var1= URI...
CVE-2019-9051
An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete articles via a /admin.php?action=deletepage&var1= URI...
Design/Logic Flaw
HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI...
CVE-2019-8407
HongCMS 3.0.0 allows arbitrary file read and write operations via a ../ in the filename parameter to the admin/index.php/language/edit URI...
CVE-2018-19507
CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI...
CVE-2018-19507
CMSimple 4.7.5 is affected by a stored/reflected XSS issue triggered by an admin request using the URI parameter ?file=config&action=array. The NVD entry indicates the vulnerability exists in the web application’s handling of user-supplied input, enabling HTML/script injection that can potentiall...
CVE-2018-19507
CMSimple 4.7.5 has XSS via an admin's use of a ?file=config&action=array URI...
PHP imap_open - Remote Code Execution (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'php imapopen Remote Code Execution', 'Description' = %q The imapopen function within php, if called without the /norsh flag, will attempt to...