CVE-2018-0655

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page...

CVE-2018-0652

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the UserGroup Management section of admin page...

Cross site scripting

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the UserGroup Management section of admin page...

Cross site scripting

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page...

CVE-2018-0655

GROWI: Cross-site scripting vulnerability (CVE-2018-0655) affects GROWI v3.1.11 and earlier. The flaw is in the app settings section of the admin page, allowing remote authenticated attackers to inject arbitrary script/HTML, potentially executing in a logged-in user’s browser. Remediation: update...

CVE-2018-0655

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page...

PT-2018-13518 · Mndpsingh287 · Wp File Manager

Name of the Vulnerable Software and Affected Versions: mndpsingh287 File Manager plugin version 2.9 Description: The issue concerns a cross-site scripting XSS problem. It occurs via the lang parameter in a "wp-admin/admin.php?page=wp file manager" request. This happens because set transient is us...

File Manager < 3.0 - Authenticated Reflected Cross-Site Scripting (XSS)

Lack of sanitisation in the lang parameter in the admin dashboard could allow attacker to perform reflected XSS attacks against logged in administrators https://example.com/wp-admin/admin.php?page=wpfilemanager&lang=zhCNalertXSS...

SQL Injection Vulnerability in the Classified Navigation System of Youk365 Website (CNVD-2018-19298)

Yuko 365 website classification navigation system is an open source navigation management system based on PHP + MYSQL development and construction. Uke365 website navigation system v1.1.3 app/admin/controller/ar.php page SQL injection vulnerability , the vulnerability stems from the system fails ...

AuraCMS Cross-Site Request Forgery Vulnerability

AuraCMS is a content management system based on PHP and MySQL. The system is characterized by simplicity and modularity. AuraCMS 2.3 version of the cross-site request forgery vulnerability , remote attackers can use admin.php?mod=users to modify the administrator password , and then add pages or...

CVE-2018-16374

Frog CMS 0.9.5 is affected by a stored cross-site scripting (XSS) vulnerability in the admin area, specifically via /admin/?/plugin/comment/settings. The issue is documented for CVE-2018-16374 and confirmed across multiple sources (NVD, CVE listings). The connected documents do not provide deeper...

CVE-2018-15849

An issue was discovered in portfolioCMS 1.0.5. There is CSRF to update the website settings via admin/aboutus.php...

CVE-2018-15843

GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field...

CVE-2018-15842

WolfCMS 0.8.3.1 has XSS via the /?/admin/page/add slug parameter...

CVE-2018-15843

GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field...

CVE-2018-15848

CVE-2018-15848 affects portfolioCMS 1.0.5. The vulnerability is a Cross-Site Request Forgery that allows a CSRF to create new pages via admin/portfolio.php?newpage=true. The issue is described with a CVSS2 base score of 6.8 (MEDIUM) and CVSS3 base score of 8.8 (HIGH) indicating network-accessible...

tp5cms Cross-site Scripting Vulnerability

tp5cms is a content management system CMS framework written in the PHP language and based on technologies such as ThinkPHP, swiper and bootstrap. A cross-site scripting vulnerability exists in tp5cms 2017-05-25 and earlier versions. A remote attacker can exploit this vulnerability to inject...

CMSeeK v1.0.7 - CMS Detection And Exploitation Suite (Scan WordPress, Joomla, Drupal And 50 Other CMSs)

What is a CMS? A content management system CMS manages the creation and modification of digital content. It typically supports multiple users in a collaborative environment. Some noteable examples are: WordPress, Joomla, Drupal etc. Release History - Version 1.0.7 07-08-2018 - Version 1.0.6...

OneThink Cross-Site Request Forgery Vulnerability

Onethink is a ThinkPHP-based content management framework for web development . A cross-site request forgery vulnerability exists in the admin.php?s=/AuthManager/addToGroup.html page in OneThink version 1.1. A remote attacker can exploit this vulnerability to gain administrator privileges...

Ukcms File Upload Vulnerability

UKcms is a content management system CMS written in the PHP language. A file upload vulnerability exists in UKcms 1.1.7 and earlier versions. The vulnerability stems from the program not strictly filtering the type of file uploads. An attacker can exploit this vulnerability by changing the...