CVE-2018-19919

Pixelimity 1.0 has Persistent XSS via the admin/portfolio.php datatitle parameter, as demonstrated by a crafted onload attribute of an SVG element...

CVE-2018-19919

Pixelimity 1.0 has Persistent XSS via the admin/portfolio.php datatitle parameter, as demonstrated by a crafted onload attribute of an SVG element...

CVE-2018-19919

Pixelimity 1.0 is affected by CVE-2018-19919: a persistent XSS flaw in the admin/portfolio.php data[title] parameter, demonstrated by a crafted onload attribute in an SVG element. This indicates that enabling arbitrary HTML/JS injection could occur through the title field when rendering the admin...

CVE-2018-19919

Pixelimity 1.0 has Persistent XSS via the admin/portfolio.php datatitle parameter, as demonstrated by a crafted onload attribute of an SVG element...

CVE-2018-19919: Improper Neutralization of Input During Web Page Generation

Pixelimity 1.0 has Persistent XSS via the admin/portfolio.php datatitle parameter, as demonstrated by a crafted onload attribute of an SVG element...

PT-2018-15164

Name of the Vulnerable Software and Affected Versions Pixelimity version 1.0 Description The issue is related to Persistent XSS, which can be exploited via the datatitle parameter in the "admin/portfolio.php" endpoint. This is demonstrated by a crafted onload attribute of an SVG element...

CVE-2018-15848: Cross-Site Request Forgery (CSRF)

An issue was discovered in portfolioCMS 1.0.5. There is CSRF to create new pages via admin/portfolio.php?newpage=true...

PT-2018-13237

Name of the Vulnerable Software and Affected Versions portfolioCMS version 1.0.5 Description An issue was discovered that allows CSRF to create new pages. This can be done via the "admin/portfolio.php?newpage=true" endpoint. Recommendations For portfolioCMS version 1.0.5, consider implementing CS...

CVE-2018-12263

portfolioCMS 1.0.5 allows upload of arbitrary .php files via the admin/portfolio.php?newpage=true URI...

CVE-2018-12263: Unrestricted Upload of File with Dangerous Type

portfolioCMS 1.0.5 allows upload of arbitrary .php files via the admin/portfolio.php?newpage=true URI...

PT-2018-11088

Name of the Vulnerable Software and Affected Versions portfolioCMS version 1.0.5 Description The issue allows the upload of arbitrary .php files via the "admin/portfolio.php?newpage=true" API endpoint. This could potentially lead to unauthorized code execution. Recommendations For portfolioCMS...

CVE-2018-12110

portfolioCMS 1.0.5 has SQL Injection via the admin/portfolio.php preview parameter...

CVE-2018-12110

portfolioCMS 1.0.5 has SQL Injection via the admin/portfolio.php preview parameter...

CVE-2018-12110: Improper Neutralization of Special Elements used in an SQL Command

portfolioCMS 1.0.5 has SQL Injection via the admin/portfolio.php preview parameter...

PT-2018-11020

Name of the Vulnerable Software and Affected Versions portfolioCMS version 1.0.5 Description The issue is related to SQL Injection, which can be exploited via the preview parameter in the "admin/portfolio.php" endpoint. Recommendations For portfolioCMS version 1.0.5, avoid using the preview...