EUVD-2008-5411

Malware in sbrugna...

CVE-2023-6984: Cross-Site Request Forgery (CSRF)

The PowerPack Addons for Elementor Free Widgets, Extensions and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.13. This is due to missing or incorrect nonce validation in the...

CVE-2022-3464: Improper Neutralization

A vulnerability classified as problematic has been found in puppyCMS up to 5.1. This affects an unknown part of the file /admin/settings.php. The manipulation of the argument sitename leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this...

CVE-2022-3464

A vulnerability classified as problematic has been found in puppyCMS up to 5.1. This affects an unknown part of the file /admin/settings.php. The manipulation of the argument sitename leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this...

CVE-2020-18889

Cross Site Request Forgery CSRF vulnerability in puppyCMS v5.1 that can change the admin's password via /admin/settings.php...

CVE-2020-18889: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF vulnerability in puppyCMS v5.1 that can change the admin's password via /admin/settings.php...

PT-2021-10252

Name of the Vulnerable Software and Affected Versions: puppyCMS version 5.1 Description: A Cross Site Request Forgery CSRF issue allows changing the admin's password via the /admin/settings.php API endpoint. Recommendations: For puppyCMS version 5.1, consider implementing proper CSRF token...

CVE-2018-17835

GetSimple CMS 3.3.15 is affected by CVE-2018-17835. The issue is a stored XSS: an administrator can inject malicious payload via the admin/settings.php Custom Permalink Structure parameter, which then contaminates any page created at the admin/pages.php URI. The vulnerability is rooted in imprope...

CVE-2018-17835: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GetSimple CMS 3.3.15. An administrator can insert stored XSS via the admin/settings.php Custom Permalink Structure parameter, which injects the XSS payload into any page created at the admin/pages.php URI...

PT-2018-14213

Name of the Vulnerable Software and Affected Versions GetSimple CMS version 3.3.15 Description An issue allows an administrator to insert stored XSS via the Custom Permalink Structure parameter at the "admin/settings.php" endpoint, which injects the XSS payload into any page created at the...

CVE-2018-17103: Cross-Site Request Forgery (CSRF)

An issue was discovered in GetSimple CMS v3.3.13. There is a CSRF vulnerability that can change the administrator's password via admin/settings.php. NOTE: The vendor reported that the PoC was sending a value for the nonce parameter...

PT-2015-3475

Name of the Vulnerable Software and Affected Versions Kandidat CMS version 1.4.2 Description The issue allows remote attackers to hijack the authentication of administrators for requests. This can be achieved through multiple cross-site request forgery CSRF vulnerabilities. Specifically, the...

CVE-2010-5319: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Kandidat CMS 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that 1 modify settings via a validate action to admin/settings.php, 2 modify pages via the what parameter to admin/edit.php, or 3 modif...

PT-2014-4250

Name of the Vulnerable Software and Affected Versions GetSimple CMS version 3.3.1 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The affected API endpoints include...

CVE-2014-1603: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS 3.3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 param parameter to admin/load.php or 2 user, 3 email, or 4 name parameter in a Save Settings action to admin/settings.php...

CVE-2012-6621: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS 3.1, 3.1.2, 3.2.3, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 Email Address or 2 Custom Permalink Structure fields in admin/settings.php; 3 path parameter to admin/upload.php; 4 err paramet...

PT-2014-2390

Name of the Vulnerable Software and Affected Versions GetSimple CMS versions 3.1, 3.1.2, 3.2.3, and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via several fields and parameters, including the Email Address and Custom Permalink Structure fields in...

Kandidat CMS 1.4.2 - Persistent Cross-Site Scripting

Vulnerability ID: HTB22648 Reference: http://www.htbridge.ch/advisory/xssvulnerabilityinkandidatcms.html Product: Kandidat CMS Vendor: Kan-Studio http://www.kan-studio.ru/ Vulnerable Version: 1.4.2 and probably prior versions Vendor Notification: 19 October 2010 Vulnerability Type: Stored XSS Cro...

CVE-2008-6535: Undefined Security Weakness

admin/settings.php in PayPal eStores allows remote attackers to bypass intended access restrictions and change the administrative password via a direct request with a modified NewAdmin parameter...

SilverNews 2.04 (Auth Bypass/LFI/RCE) Multiple Vulnerabilities

No description provided by source. 0x01 Informations: Name : SilverNews 2.04 Download : http://www.silver-scripts.de/scripts.php?script=SilverNews&l=en Vulnerability : Auth Bypass\LFI\RCE Author : x0r Contact : [email protected] Notes : Proud to be Italian 0x02 Bug: Bugged file is...