5011 matches found
CVE-2018-10430
An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...
Nextcloud: Bruteforce in admin panel
Hello there, Admin panel of your website https://nextcloud.com/wp-login.php is vulnerable to bruteforce attacks as their is no rate-limiting. Impact Can gain access to admin panel. To fix this, Just add rate limiting...
iScripts UberforX Cross-Site Request Forgery Vulnerability
IScripts UberforX is an open source e-commerce solution from Iscripts USA. The solution has features such as inventory management, payment gateway support, and hole-in-the-ground application support.Admin Panel is one of the admin panels. A cross-site request forgery vulnerability exists in the...
iScripts UberforX Cross-Site Scripting Vulnerability
IScripts UberforX is an open source e-commerce solution from Iscripts USA. The solution has features such as inventory management, payment gateway support, and hole-in-the-ground application support.Admin Panel is one of the admin panels. A cross-site scripting vulnerability exists in the...
CVE-2018-10137
iScripts UberforX 2.2 has CSRF in the "managesettings" section of the Admin Panel via the /cms?section=managesettings&action=edit URI...
Cross site request forgery (csrf)
iScripts UberforX 2.2 has CSRF in the "managesettings" section of the Admin Panel via the /cms?section=managesettings&action=edit URI...
CVE-2018-10137
iScripts UberforX 2.2 has CSRF in the "managesettings" section of the Admin Panel via the /cms?section=managesettings&action=edit URI...
CVE-2018-10136
iScripts UberforX 2.2 has Stored XSS in the "managesettings" section of the Admin Panel via a value field to the /cms?section=managesettings&action=edit URI...
Cross site scripting
iScripts UberforX 2.2 has Stored XSS in the "managesettings" section of the Admin Panel via a value field to the /cms?section=managesettings&action=edit URI...
CVE-2018-10136
iScripts UberforX 2.2 has Stored XSS in the "managesettings" section of the Admin Panel via a value field to the /cms?section=managesettings&action=edit URI...
CVE-2018-10137
iScripts UberforX 2.2 has CSRF in the "managesettings" section of the Admin Panel via the /cms?section=managesettings&action=edit URI...
CVE-2018-10136
Vulnerability summary (CVE-2018-10136): iScripts UberforX 2.2 contains a Stored XSS in the Admin Panel under the “manage_settings” page, exploitable by injecting script via the value field in the URI /cms?section=manage_settings&action=edit. The Red Hat and CNVD entries corroborate the same issue...
CVE-2018-10137
CSRF in iScripts UberforX 2.2 Admin Panel: the issue is in the manage_settings section exposed at /cms?section=manage_settings&action=edit. CVSS3 base score 8.8 (HIGH); attack vector NETWORK, user interaction REQUIRED, impacts on C/I/A HIGH. No exploitation details are provided in the documents; ...
CVE-2018-10121
plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the title section of an admin/index.php?id=pages&action=editpage&name=error404 aka Edit 404 page action...
CVE-2018-10121
plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the title section of an admin/index.php?id=pages&action=editpage&name=error404 aka Edit 404 page action...
CVE-2018-10083
CMS Made Simple CMSMS through 2.2.7 contains an arbitrary file deletion vulnerability in the admin dashboard via directory traversal sequences in the val parameter within a cmd=del request, because code under modules\FilePicker does not restrict the val parameter...
iScripts eSwap SQL Injection Vulnerability
IScripts eSwap is an item trading program from IScripts Inc. that supports the use of virtual currency or direct item exchange. The program supports the use of virtual currencies to trade or directly exchange items.User Panel is one of the user panels. A SQL injection vulnerability exists in...
iScripts eSwap registration_settings.php cross-site scripting vulnerability
IScripts eSwap is an item trading software from IScripts Inc. The program supports the use of virtual currencies for trading or direct item exchange.User Panel is one of the user panels. A cross-site scripting vulnerability exists in iScripts eSwap v2.4. The vulnerability can be exploited via the...
Mail.ru: 3rd party shop admin panel blind XSS
Blind XSS in third party shop's admin panel. This host and company is not operated or owned by Mail.Ru Group, but it runs an online shop and processes orders for Mail.Ru branded gift shop. It does not have any privileged/additional access to Mail.Ru network or user's data. Gift shop is not...