2398 matches found
CVE-2019-11568
An issue was discovered in AikCms v2.0. There is a File upload vulnerability, as demonstrated by an admin/page/system/nav.php request with PHP code in a .php file with the application/octet-stream content type...
Okadminfinder3 - Admin Panel Finder / Admin Login Page Finder
OKadminFinder is an Apache2 Licensed utility, rewritten in Python 3.x , for admins/pentesters who want to find admin panel of a website. There are many other tools but not as effective and secure. Yeah, Okadminfinder has the the ability to use tor and hide your identity. Requirements Linux sudo a...
Cross-Site Scripting
Overview All versions of harp are vulnerable to Cross-Site Scripting. In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code. This is limited to the admin page and does not affect other pages. Recommendation No fix is...
HYBBS Cross-Site Request Forgery Vulnerability
HYBBS is a lightweight community forum program. A cross-site request forgery vulnerability exists in the /?admin/user.html page in HYBBS version 2.2, which originates from a WEB application that does not adequately validate whether a request is from a trusted user. An attacker could exploit this...
CVE-2019-9058
An issue was discovered in CMS Made Simple 2.2.8. In the administrator page admin/changegroupperm.php, it is possible to send a crafted value in the selgroups parameter that leads to authenticated object injection...
CVE-2019-9911
The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS...
CVE-2019-7424
XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/index.jsp" file in the view GET parameter or any of these POST parameters: autorefTime, section, snapshot, viewOpt, viewAll, view, or groupSelName. The latter is related to...
PT-2019-19931 · WordPress · Wp-Live-Chat-Support
Name of the Vulnerable Software and Affected Versions: wp-live-chat-support plugin versions prior to 8.0.18 Description: The issue concerns a term XSS in the wp-live-chat-support plugin for WordPress, specifically affecting the wp-admin/admin.php?page=wplivechat-menu-gdpr-page endpoint...
WordPress Contact Form Email Plugin Cross-Site Scripting Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Contact Form Email plugin is used in one of the email management plugin. A cross-site scripting vulnerability exists in the...
Cscms Cross-Site Scripting Vulnerability (CNVD-2019-07948)
CScms is a content management system CMS developed on a CI framework. A cross-site scripting vulnerability exists in the admin.php/pay page in Cscms version 4.1.0. A remote attacker can exploit the vulnerability to change the paypal account...
Cross site scripting
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox aka site logo of "System setting-site setting" of admin/index.php, aka sitelogo...
CVE-2019-8438
An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the first textbox of "System setting-site setting" of admin/index.php, aka sitename...
CVE-2019-9576
The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS...
CVE-2019-9551
An issue was discovered in DOYO aka doyocms 2.3 through 2015-05-06. It has admin.php XSS...
Tautulli 2.1.26 Cross Site Scripting
Tautulli https://tautulli.com/ is a Python based monitoring and tracking tool for Plex Media Server. We discovered that an authenticated Plex Media Server user could change their Plex username to include JavaScript and Tautulli would fail to sanitize the username so that when the Plex Media Serve...
Directory traversal
admin/dldata.php in zzcms 2018 2018-10-19 allows remote attackers to delete arbitrary files via action=del&filename=../ directory traversal...
CVE-2018-20773
Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional ?php lines...
Design/Logic Flaw
Frog CMS 0.9.5 allows PHP code execution by visiting admin/?/page/edit/1 and inserting additional ?php lines...
