452 matches found
CVE-2019-11398
Multiple cross-site scripting XSS vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon...
Cross site scripting
WeBid 1.2.2 has reflected XSS via the id parameter to admin/deletenews.php, admin/editbannersuser.php, admin/editfaqscategory.php, or admin/excludeuser.php, or the offset parameter to admin/edituser.php...
Vulnerabilities in the web interface of the Cisco Identity Services Engine, a platform for managing network policies, allow attackers to gain access to protected information.
The vulnerability in the web interface of the Cisco Identity Services Engine management platform relates to insufficient protection of saved passwords when configuring pages on the administrator portal. Exploiting this vulnerability can allow a malicious actor to gain access to protected...
CVE-2019-6126
The Admin Panel of PHP Scripts Mall Advance Peer to Peer MLM Script v1.7.0 allows remote attackers to bypass intended access restrictions by directly navigating to admin/dashboard.php or admin/user.php, as demonstrated by disclosure of information about users and staff...
CVE-2018-15563
core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titlesen parameter...
CVE-2018-15563: Improper Neutralization of Input During Web Page Generation
core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titlesen parameter...
CVE-2018-16772
Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new...
Sql injection
Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new...
CVE-2018-16772
Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new...
CVE-2018-16772
CVE-2018-16772 affects Hoosk v1.7.0. The vulnerability is a cross-site scripting (XSS) issue exploitable via the Navigation Title when creating a new page at admin/pages/new. The attack vector is user-facing via the web interface, with the underlying cause described as a navigation title handling...
Hoosk Cross-Site Scripting Vulnerability
Hoosk is a lightweight user-centered content management system CMS. The system has built-in Codelgniter for creating responsive websites. A cross-site scripting vulnerability exists in Hoosk 1.7.0, which can be exploited by an attacker via the navigation title of a new page entered at...
CVE-2018-16772: Improper Neutralization of Input During Web Page Generation
Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new...
PLANEX CS-QR20 Arbitrary Code Execution Vulnerability
PLANEX is a Japanese networking brand company brands PCI and PLANEX. We provide products from enterprise customers to home customers e.g., network cards, routers, switches, L3 managed switches, accessories, Bluetooth products, print servers, Apple peripherals, network storage devices, etc.. PLANE...
PT-2018-12945 · Ignited · Ignited Cms
Name of the Vulnerable Software and Affected Versions: Ignited CMS versions prior to 2017-02-19 Description: The issue allows a CSRF attack, enabling an attacker to add pages. This is possible through the "ign/index.php/admin/pages/add page" API endpoint, specifically by manipulating the request ...
CVE-2018-15203: Cross-Site Request Forgery (CSRF)
An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/addpage allows a CSRF attack to add pages...
Cisco Finesse Server-Side Request Forgery Vulnerability (CNVD-2018-14233)
Cisco Finesse is a suite of call center management software. The software enhances call center service quality, improves customer experience, and increases agent satisfaction. Cisco Finesse suffers from a server-side request forgery vulnerability in the web-based administration pages, which stems...
SQL Injection
dolibarr/dolibarr is vulnerable to SQL injection attacks. The vulnerability exists through the sortfield parameter which affects /accountancy/admin/accountmodel.php, /accountancy/admin/categorieslist.php, /accountancy/admin/journalslist.php, /admin/dict.php, /admin/mailstemplates.php, and...
UBUNTU-CVE-2018-9019
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categorieslist.php, /accountancy/admin/journalslist.php, /admin/dict.php,...
CVE-2018-9019
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to /accountancy/admin/accountmodel.php, /accountancy/admin/categorieslist.php, /accountancy/admin/journalslist.php, /admin/dict.php,...