CVE-2018-0655

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page...

CVE-2018-0652

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the UserGroup Management section of admin page...

Cross site scripting

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page...

Cross site scripting

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the UserGroup Management section of admin page...

CVE-2018-0655

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page...

CVE-2018-0655

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page...

CVE-2018-0655

GROWI: Cross-site scripting vulnerability (CVE-2018-0655) affects GROWI v3.1.11 and earlier. The flaw is in the app settings section of the admin page, allowing remote authenticated attackers to inject arbitrary script/HTML, potentially executing in a logged-in user’s browser. Remediation: update...

PT-2018-13518 · Mndpsingh287 · Wp File Manager

Name of the Vulnerable Software and Affected Versions: mndpsingh287 File Manager plugin version 2.9 Description: The issue concerns a cross-site scripting XSS problem. It occurs via the lang parameter in a "wp-admin/admin.php?page=wp file manager" request. This happens because set transient is us...

PT-2018-8993

Name of the Vulnerable Software and Affected Versions GROWI versions 3.1.11 and earlier Description A cross-site scripting issue allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of the admin page. Recommendations For GROWI versions 3.1.11 a...

CVE-2018-0655: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in GROWI v.3.1.11 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via the app settings section of admin page...

File Manager < 3.0 - Authenticated Reflected Cross-Site Scripting (XSS)

Lack of sanitisation in the lang parameter in the admin dashboard could allow attacker to perform reflected XSS attacks against logged in administrators https://example.com/wp-admin/admin.php?page=wpfilemanager&lang=zhCNalertXSS...

SQL Injection Vulnerability in the Classified Navigation System of Youk365 Website (CNVD-2018-19298)

Yuko 365 website classification navigation system is an open source navigation management system based on PHP + MYSQL development and construction. Uke365 website navigation system v1.1.3 app/admin/controller/ar.php page SQL injection vulnerability , the vulnerability stems from the system fails ...

AuraCMS Cross-Site Request Forgery Vulnerability

AuraCMS is a content management system based on PHP and MySQL. The system is characterized by simplicity and modularity. AuraCMS 2.3 version of the cross-site request forgery vulnerability , remote attackers can use admin.php?mod=users to modify the administrator password , and then add pages or...

CVE-2018-16374

Frog CMS 0.9.5 is affected by a stored cross-site scripting (XSS) vulnerability in the admin area, specifically via /admin/?/plugin/comment/settings. The issue is documented for CVE-2018-16374 and confirmed across multiple sources (NVD, CVE listings). The connected documents do not provide deeper...

CVE-2018-15849

An issue was discovered in portfolioCMS 1.0.5. There is CSRF to update the website settings via admin/aboutus.php...

CVE-2018-15843

GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field...

CVE-2018-15842

WolfCMS 0.8.3.1 has XSS via the /?/admin/page/add slug parameter...

CVE-2018-15843

GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field...

CVE-2018-15848

CVE-2018-15848 affects portfolioCMS 1.0.5. The vulnerability is a Cross-Site Request Forgery that allows a CSRF to create new pages via admin/portfolio.php?newpage=true. The issue is described with a CVSS2 base score of 6.8 (MEDIUM) and CVSS3 base score of 8.8 (HIGH) indicating network-accessible...

PT-2018-13231

Name of the Vulnerable Software and Affected Versions WolfCMS version 0.8.3.1 Description The issue is related to a security problem where an attacker can inject malicious code. The /admin/page/add endpoint is affected, specifically through the slug parameter. Recommendations For WolfCMS version...