PT-2018-14641

Name of the Vulnerable Software and Affected Versions Microstrategy Web version 7 Description The issue is related to insufficient encoding of user-controlled inputs, leading to a Cross-Site Scripting XSS vulnerability. This can be exploited via the ShowAll parameter in the "admin/admin.asp"...

CVE-2018-18776: Improper Neutralization of Input During Web Page Generation

Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability via the admin/admin.asp ShowAll parameter. NOTE: this is a deprecated product...

Sql injection

admin/check.asp in DKCMS 9.4 allows SQL Injection via an ASPSESSIONID cookie to admin/admin.asp...

PT-2018-14681

Name of the Vulnerable Software and Affected Versions DKCMS version 9.4 Description The issue allows SQL Injection via an ASPSESSIONID cookie to admin/admin.asp. This is related to the admin/check.asp file in DKCMS. Recommendations For DKCMS version 9.4, consider restricting access to the...

CVE-2018-14960

Xiao5uCompany 1.7 has CSRF via admin/Admin.asp...

PT-2018-12837

Name of the Vulnerable Software and Affected Versions Xiao5uCompany version 1.7 Description The issue is related to a CSRF Cross-Site Request Forgery vulnerability. It affects the admin/Admin.asp endpoint. Recommendations For version 1.7, update to a version that includes a fix for this issue, if...

CVE-2018-14960: Cross-Site Request Forgery (CSRF)

Xiao5uCompany 1.7 has CSRF via admin/Admin.asp...

Sql injection

Multiple SQL injection vulnerabilities in default.asp in MyDesign Sayac 2.0 allow remote attackers to execute arbitrary SQL commands via 1 the user parameter aka UserName field or 2 the pass parameter aka Pass field to a admin/admin.asp or b the default URI under admin/. NOTE: some of these detai...