PT-2021-10339

Name of the Vulnerable Software and Affected Versions: Metinfo version 7.0.0 Description: The issue allows attackers to perform a directory traversal and access sensitive information through the /admin/index.php?n=system&c=filept&a=doGetFileList endpoint. Recommendations: For Metinfo version 7.0....

CVE-2020-19304: Improper Limitation of a Pathname to a Restricted Directory

An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and access sensitive information...

CVE-2020-18157

Cross Site Request Forgery CSRF vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php...

CVE-2020-18157

Cross Site Request Forgery CSRF vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php...

PT-2021-10142

Name of the Vulnerable Software and Affected Versions: MetInfo version 6.1.3 Description: A Cross Site Request Forgery CSRF issue exists, which can be exploited via a doaddsave action in the admin/index.php API endpoint. This allows for unauthorized actions to be performed on behalf of a user...

CVE-2020-18157: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability in MetInfo 6.1.3 via a doaddsave action in admin/index.php...

CVE-2020-23697

Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php...

CVE-2020-23697: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php...

PT-2021-10928

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue is related to a Cross Site Scripting vulnerability in the page feature of admin/index.php. This vulnerability can be exploited via the page feature. Recommendations For Monstra CMS version 3.0.4,...

CVE-2020-18648: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF in JuQingCMS v1.0 allows remote attackers to gain local privileges via the component "JuQingCMSv1.0/admin/index.php?c=administrator&a=add"...

PT-2021-3633

Name of the Vulnerable Software and Affected Versions Hongcms versions 4.0.0 Description The issue is related to a path traversal vulnerability in the /hcms/admin/index.php/language/ajax component of the Hongcms content management system. This vulnerability can be exploited by a remote attacker t...

CVE-2020-18178: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax."...

CVE-2020-21590

Directory traversal in coreframe/app/template/admin/index.php in WUZHI CMS 4.1.0 allows attackers to list files in arbitrary directories via the dir parameter...

PT-2021-10645

Name of the Vulnerable Software and Affected Versions: WUZHI CMS version 4.1.0 Description: The issue allows attackers to list files in arbitrary directories via the dir parameter in the coreframe/app/template/admin/index.php file. This is a directory traversal issue that can be exploited by...

CVE-2020-21590: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal in coreframe/app/template/admin/index.php in WUZHI CMS 4.1.0 allows attackers to list files in arbitrary directories via the dir parameter...

PT-2021-18034

Name of the Vulnerable Software and Affected Versions: Bitweaver version 3.1.0 Description: A cross-site scripting XSS issue allows remote attackers to inject JavaScript via the "/users/admin/index.php" API endpoint. This enables attackers to execute malicious scripts on the client-side...

CVE-2021-29030: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/index.php URI...

CVE-2020-35709

bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...

CVE-2020-35709: Improper Limitation of a Pathname to a Restricted Directory

bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...

PT-2020-17398

Name of the Vulnerable Software and Affected Versions bloofoxCMS version 0.5.2.1 Description The issue allows admins to upload arbitrary .php files to ../media/images/ via the "admin/index.php?mode=tools&page=upload" URI, which is a directory traversal issue. This is achieved by using a...