569 matches found
CVE-2018-18626: Undefined Security Weakness
An issue was discovered in PHPYun V4.6. There is a vulnerability that can delete any file or directory via the "admin/index.php?m=database&c=del" sql parameter because delaction in admin/model/database.class.php mishandles this parameter...
CVE-2018-18374: Improper Neutralization of Input During Web Page Generation
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter...
CVE-2018-18323
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=fileeditor&file=/../ URI...
CVE-2018-18322
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php servicestart, servicerestart, servicefullstatus, or servicestop parameter...
CVE-2018-18324: Improper Neutralization of Input During Web Page Generation
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fmcurrentdir parameter, or the admin/index.php module, servicestart, servicefullstatus, servicerestart, servicestop, or file within the fileeditor parameter...
CVE-2018-18322: Improper Neutralization of Special Elements used in an OS Command
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php servicestart, servicerestart, servicefullstatus, or servicestop parameter...
CVE-2018-18323: Improper Limitation of a Pathname to a Restricted Directory
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=fileeditor&file=/../ URI...
CVE-2018-18296: Improper Neutralization of Input During Web Page Generation
MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action...
CVE-2018-18209: Improper Neutralization of Input During Web Page Generation
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenttype parameter...
CVE-2018-18210: Improper Neutralization of Input During Web Page Generation
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenturl parameter...
CVE-2018-18201: Cross-Site Request Forgery (CSRF)
qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account...
CVE-2018-16820
Monstra CMS 3.0.4 is affected by a directory-traversal in admin/index.php, exploitable via id=filesmanager&path=uploads/… requests to list arbitrary directories. Root cause is improper handling of the path parameter that enables traversal. Impact per NVD: High (CVSSv3 7.5) for confidentiality los...
CVE-2018-16820: Improper Limitation of a Pathname to a Restricted Directory
admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests...
CVE-2018-16819: Improper Limitation of a Pathname to a Restricted Directory
admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&deletefile= requests...
CVE-2018-17024
admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an addpage action...
CVE-2018-17025
CVE-2018-17025 affects Monstra CMS 3.0.4. The issue is an XSS in admin/index.php via the page_meta_title parameter in an edit_page action for pages with no special role. Documented impact is XSS; no exploitation details are provided in the sources. CVSS scores listed: CVSS v2 base 4.3 (Medium) an...
CVE-2018-17026: Improper Neutralization of Input During Web Page Generation
admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage&name=error404 action, a different vulnerability than CVE-2018-10121...
CVE-2018-17025: Improper Neutralization of Input During Web Page Generation
admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage action for a page with no special role...
CVE-2018-17024: Improper Neutralization of Input During Web Page Generation
admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an addpage action...
