CVE-2018-18721

An XSS issue was discovered in admin/link/editlink?id=5 in YUNUCMS 1.1.5...

DESTOON B2B Cross-Site Scripting Vulnerability

DESTOON B2B is a PHP and MySQL based on open source B2B e-commerce website management system . A cross-site scripting vulnerability exists in the admin\setting.inc.php page in DESTOON B2B version 7.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via the...

DESTOON B2B Cross-Site Request Forgery Vulnerability

DESTOON B2B is a PHP and MySQL based open source B2B e-commerce website management system . A cross-site request forgery vulnerability exists in DESTOON B2B version 7.0. A remote attacker can exploit this vulnerability by using the admin.php URI in the action=add request to perform unauthorized...

CVE-2018-18433

An issue was discovered in DESTOON B2B 7.0. admin/category.inc.php has XSS via the categorycatname parameter to the admin.php URI...

Cross site scripting

XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter...

CVE-2018-18374

XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter...

CVE-2018-18374

XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter...

CVE-2018-18259

Stored XSS has been discovered in version 1.0.12 of the LUYA CMS software via /admin/api-cms-nav/create-page...

CVE-2018-18259

Stored XSS has been discovered in version 1.0.12 of the LUYA CMS software via /admin/api-cms-nav/create-page...

CVE-2018-18271

XSS exists in CMS Made Simple version 2.2.7 via the m1extra parameter in an admin/moduleinterface.php "Content--News--Add Article" action...

CVE-2018-18191

Cross-site request forgery CSRF vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password...

CVE-2018-17884

XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook gwolle-gb plugin before 2.5.4 for WordPress via the PATHINFO to wp-admin/index.php...

Arbitrary file deletion

admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&deletefile= requests...

CVE-2018-17140

The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a qlinsert action to wp-admin/admin.php...

CVE-2018-17086

An issue was discovered in OTCMS 3.61. XSS exists in admin/shareswitch.php via these parameters: fieldName fieldName2 tabName...

CVE-2018-17086

An issue was discovered in OTCMS 3.61. XSS exists in admin/shareswitch.php via these parameters: fieldName fieldName2 tabName...

CVE-2018-17026

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage&name=error404 action, a different vulnerability than CVE-2018-10121...

Cross site scripting

Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages-manage under admin.php?action=files...

WESEEK GROWI cross-site scripting vulnerability (CNVD-2021-17765)

WESEEK GROWI is an open source team collaboration software developed by WESEEK Japan. The software features asset management, quick search and member management. A cross-site scripting vulnerability exists in WESEEK GROWI 3.1.11 and earlier versions. A remote attacker can exploit this vulnerabili...

CVE-2018-16363

The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wpfilemanager request because settransient is used in filefoldermanager.php and there is an echo of lang in lib\wpfilemanager.php...