2762 matches found
CVE-2018-8832
enhavo 0.4.0 (PHP Symfony-based CMS) has a cross-site scripting vulnerability where a user-group name can contain executable JavaScript. The attack triggers when a victim visits the admin user group page, indicating that the vulnerable input is not properly sanitized on that page. The available s...
CVE-2018-6883
Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags request. The attacker must be an administrator...
CVE-2018-6890
Cross-site scripting XSS vulnerability in Wolf CMS 0.8.3.1 via the page editing feature, as demonstrated by /?/admin/page/edit/3...
Custom Permalinks <= 1.1 - Cross-Site Scripting (XSS)
User controllable input in the admin page of Custom Permalinks gets output without any escaping. URL/wp-admin/admin.php?page=custom-permalinks-post-permalinks&s=alert1...
PT-2018-17805
Name of the Vulnerable Software and Affected Versions Wolf CMS version 0.8.3.1 Description A cross-site scripting XSS issue exists in the page editing feature. This can be demonstrated via the "/?/admin/page/edit/3" API endpoint. Recommendations For version 0.8.3.1, consider disabling the page...
Custom Permalinks <= 1.1 - Authenticated SQL Injection
Missing checking of user controllable input during Bulk Action in the Custom Permalinks backend page leads to SQL injection vulnerability. Send authenticated POST request to "URL/wp-admin/admin.php?page=custom-permalinks-post-permalinks" with parameters "action=delete&permalinks=1 PAYLOAD -- "...
CVE-2018-6890: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Wolf CMS 0.8.3.1 via the page editing feature, as demonstrated by /?/admin/page/edit/3...
Custom Permalinks <= 1.1 - Cross-Site Scripting (XSS)
User controllable input in the admin page of Custom Permalinks gets output without any escaping. PoC URL/wp-admin/admin.php?page=custom-permalinks-post-permalinks=...
Code injection
CMS Made Simple CMSMS 2.2.5 has XSS in admin/addbookmark.php via the title parameter...
WordPress booking-calendar plugin cross-site request forgery vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. booking-calendar plugin is used in one of the online booking plugin. A cross-site request forgery vulnerability...
CVE-2018-5690
Cross-site scripting XSS vulnerability in admin/users.php in Dotclear 2.12.1 allows remote authenticated users to inject arbitrary web script or HTML via the nb parameter aka the page limit number...
CVE-2018-5673
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php...
Design/Logic Flaw
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php socialicon1 parameter...
Design/Logic Flaw
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php bgcolor parameter...
CVE-2018-5310
In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?page=mediafromftp-search-register URI...
CVE-2018-5311
The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjooecaeoptionscustomcss parameter to the wp-admin/admin.php?page=tonjooexcerpt URI...
SQL injection vulnerability in phpaaCMS v0.5 category.action.php page
phpaaCMS is a simple article management system. A SQL injection vulnerability exists in the /admin/category.action.php page of phpaaCMS v0.5, which can be exploited by attackers to obtain sensitive database information...
CVE-2018-5286
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page...