CVE-2018-19224

An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies...

Sql injection

An issue was discovered in LAOBANCMS 2.0. It allows SQL Injection via the admin/login.php guanliyuan parameter...

CVE-2018-19221

An issue was discovered in LAOBANCMS 2.0. It allows SQL Injection via the admin/login.php guanliyuan parameter...

Spoofing

An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies...

CVE-2018-19224

An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies...

CVE-2018-19221

An issue was discovered in LAOBANCMS 2.0. It allows SQL Injection via the admin/login.php guanliyuan parameter...

CVE-2018-19224

LAOBANCMS 2.0 contains a vulnerability in /admin/login.php that allows spoofing of the id and guanliyuan cookies. The records (CVE-2018-19224) confirm this issue but do not provide the underlying technical flaw, affected versions beyond 2.0, specific exploit details, or remediation guidance in th...

phptpoint Pharmacy Management System 1.0 - username SQL Injection

phptpoint Pharmacy Management System 1.0 - username SQL Injection Exploit Title: phptpoint Pharmacy Management System 1.0 - 'username' SQL injection Date: 2018-10-24 Exploit Author: Boumediene KADDOUR Unit: Algerie Telecom R&D Unit Vendor Homepage: https://www.phptpoint.com/ Software Link:...

CVE-2018-18790

An issue was discovered in zzcms 8.3. SQL Injection exists in admin/specialadd.php via a zxbigclassid cookie. This needs an admin user login...

CVE-2018-18788

An issue was discovered in zzcms 8.3. SQL Injection exists in admin/classmanage.php via the tablename parameter. This needs an admin user login...

CVE-2018-18784

An issue was discovered in zzcms 8.3. SQL Injection exists in admin/tagmanage.php via the tabletag parameter. This needs an admin user login...

CVE-2018-18790

CVE-2018-18790 affects ZZCMS 8.3. An SQL Injection exists in admin/special_add.php exploitable via the zxbigclassid cookie (admin login required). The issue can lead to partial disclosure/integrity/availability impact with high severity per CVSSv3 (HIGH for confidentiality, integrity, availabilit...

CVE-2018-18788

CVE-2018-18788 affects ZZCMS v8.3, where SQL injection exists in the admin/classmanage.php file via the unvalidated tablename parameter. The vulnerability requires an admin user login and can allow an attacker to read MySQL data (e.g., current user name) as described in CNVD/NVD references. Affec...

MailCleaner CE Cross-Site Scripting Vulnerability

MailCleaner CE is an open source anti-spam gateway. The product is deployed between the mail infrastructure and the Internet and has features such as virus protection. A cross-site scripting vulnerability exists in the www/guis/admin/application/controllers/UserController.php file in the admin...

CVE-2018-18377

goform/setReset on Orange AirBox Y858FL01.1604 devices allows attackers to reset a router to factory settings, which can be used to login using the default admin:admin credentials...

youke365 SQL Injection Vulnerability

youke365 is an open source navigation management system. The admin/login.html page in version 1.1.5 of youke365 suffers from a SQL injection vulnerability that can be exploited by remote attackers to execute arbitrary SQL commands...

trautwein-matten.de XSS vulnerability

Open Bug Bounty ID: OBB-685142 Description| Value ---|--- Affected Website:| trautwein-matten.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-18242

youke365 v1.1.5 has SQL injection via admin/login.html, as demonstrated by username=admin&pass=123456&code=9823&act=login&submit=%E7%99%BB+%E9%99%86...

CVE-2018-18242

The CVE-2018-18242 entry relates to youke365 v1.1.5, which has a SQL injection in admin/login.html. The vulnerability arises from improper handling in the login endpoint, enabling an attacker to inject SQL and, per CNVD-2018-20869, potentially execute arbitrary SQL commands remotely. NVD metrics ...

Hot Drama CMS v2.1 has a flawed logic vulnerability

Hot Drama CMS is a movie and TV station building system developed by PHP+MySQL. There is a logic flaw vulnerability in /admin/cm.php in Hot Drama CMS v2.1, which can be exploited by an attacker to log in to the administration background by modifying the cookie value...