CVE-2019-12094: Improper Neutralization of Input During Web Page Generation

Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=updatef&username= or admin/user.php?form=removef&username= or admin/config/diff.php?app= URI...

CVE-2019-9661

Stored XSS exists in YzmCMS 5.2 via the admin/systemmanage/userconfigedit.html "value" parameter,...

PT-2018-13875

Name of the Vulnerable Software and Affected Versions UNL-CMS version 7.59 Description An issue was discovered that allows a CSRF attack to update website settings via the "/admin/config/system/site-information" API endpoint. Recommendations For UNL-CMS version 7.59, update the software to a...

CVE-2018-14517

SeaCMS 6.61 has two XSS issues in the adminconfig.php file via certain form fields...

SeaCMS Cross-Site Scripting Vulnerability (CNVD-2018-14550)

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in SeaCMS version 6.61. A remote attacker can exploit this vulnerability by sending the 'site name...

PT-2018-18150

Name of the Vulnerable Software and Affected Versions lyadmin versions 1.x Description The issue allows for XSS via the configWEB SITE TITLE parameter to the "/admin.php?s=/admin/config/groupsave.html" API endpoint. Recommendations For lyadmin version 1.x, update to a version that fixes this issu...

CVE-2018-7547: Improper Neutralization of Input During Web Page Generation

lyadmin 1.x has XSS via the configWEBSITETITLE parameter to the /admin.php?s=/admin/config/groupsave.html URI...

CVE-2016-2002

The validateAdminConfig handler in the Analytics Management Console in HPE Vertica 7.0.x before 7.0.2.12, 7.1.x before 7.1.2-12, and 7.2.x before 7.2.2-1 allows remote attackers to execute arbitrary commands via the mcPort parameter, aka ZDI-CAN-3417...

Hewlett Packard Enterprise Vertica validateAdminConfig Processor Arbitrary Command Execution Vulnerability

Hewlett Packard Enterprise Vertica is a data mining analysis system for SQL databases from Hewlett Packard Enterprise HPE. A security vulnerability exists in the validateAdminConfig processor in HPE Vertica. A remote attacker could exploit the vulnerability by providing the 'mcPort' parameter...

PT-2015-6546

Name of the Vulnerable Software and Affected Versions Campaign Monitor module versions 7.x-1.0 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities in the Campaign Monitor module for Drupal. These vulnerabilities allow remote attackers to hijack the authenticati...

PT-2014-8767

Name of the Vulnerable Software and Affected Versions MantisBT versions 1.2.13 through 1.2.17 Description A cross-site scripting XSS issue exists in the selection list in the filters on the Configuration Report page, specifically in the adm config report.php file. This allows remote administrator...

CVE-2014-7870

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with the "administer custom search" permission to inject arbitrary web script or HTML via the "Label text" field to...

PT-2014-8322

Name of the Vulnerable Software and Affected Versions Drupal Custom Search module versions 6.x-1.x before 6.x-1.12 Drupal Custom Search module versions 7.x-1.x before 7.x-1.14 Description A cross-site scripting XSS issue exists in the Custom Search module for Drupal, allowing remote authenticated...

NavBoard 2.6.0 - Remote Code Execution Exploit

No description provided by source. ?php / \|/// \ - - // @ @ ----oOOo---oOOo--------------------------------------------------- Y! Underground Group [email protected] Dj7xpl.2600.ir ----ooooO-----Ooooo-------------------------------------------------- \ / \ /...

PT-2013-4931

Name of the Vulnerable Software and Affected Versions Password Policy module versions 6.x-1.x before 6.x-1.6 Password Policy module versions 7.x-1.x before 7.x-1.5 Description The issue allows remote authenticated users with the "Administer policies" permission to inject arbitrary web script or...

DimacCMS xs <=1.3 Multiple Vulnerability

Exploit for php platform in category web applications Title : DimacCMS xs Exploit : 1 http://localhost/path...

DimacCMS XS 1.3 SQL Injection / Database Disclosure

Title : DimacCMS xs Exploit : 1 http://localhost/path/SiteResources/Data/...

CVE-2006-6818: Undefined Security Weakness

AlstraSoft Web Host Directory allows remote attackers to bypass authentication and change the admin password via a direct request to admin/config...

CVE-2006-6479

Multiple cross-site scripting XSS vulnerabilities in AnnonceScriptHP 2.0 allow remote attackers to inject arbitrary web script or HTML via the email parameter in 1 erreurinscription.php, 2 Templates/admin.dwt.php, 3 Templates/commun.dwt.php, 4 membre.dwt.php, and 5 admin/adminconfig/Aide.php...

CVE-2006-1545

Direct static code injection vulnerability in admin/config.php in vscripts aka Kuba Kunkiewicz VNews 1.2 allows remote authenticated administrators to execute code by inserting the code into variables that are stored in admin/config.php...