CVE-2017-11678

SQL injection vulnerability in Hashtopus 1.5g allows remote authenticated users to execute arbitrary SQL commands via the format parameter in admin.php...

CVE-2017-11677

Hashtopus 1.5g is affected by a Cross-Site Scripting (XSS) vulnerability that can be triggered by a crafted query string sent to admin.php, enabling the injection of arbitrary web script or HTML. The root cause is an input handling flaw in the web interface that processes the query string without...

CVE-2017-11679

CVE-2017-11679 describes a CSRF in Hashtopus 1.5g where an attacker can trigger actions via the password parameter to admin.php in an a=config action. The connected records confirm the vulnerability exists in Hashtopus 1.5g and identify the vulnerable parameter and endpoint, but they do not provi...

CVE-2017-11679

Cross-Site Request Forgery CSRF exists in Hashtopus 1.5g via the password parameter to admin.php in an a=config action...

CVE-2017-11678

Hashtopus has a reported SQL injection vulnerability (CVE-2017-11678) affecting version 1.5g. The issue allows an attacker who is authenticated remotely to execute arbitrary SQL commands via the format parameter in admin.php, potentially impacting data confidentiality, integrity, and availability...

PT-2017-12169

Name of the Vulnerable Software and Affected Versions Hashtopus version 1.5g Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the format parameter in the "admin.php" API endpoint. Recommendations For version 1.5g, avoid using the form...

CVE-2017-11679: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF exists in Hashtopus 1.5g via the password parameter to admin.php in an a=config action...

PT-2017-12168

Name of the Vulnerable Software and Affected Versions Hashtopus version 1.5g Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the query string to "admin.php". This could potentially lead to unauthorized actions on the affected system...

CVE-2017-11677: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Hashtopus 1.5g allows remote attackers to inject arbitrary web script or HTML via the query string to admin.php...

CVE-2017-11678: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Hashtopus 1.5g allows remote authenticated users to execute arbitrary SQL commands via the format parameter in admin.php...

PT-2017-12170

Name of the Vulnerable Software and Affected Versions Hashtopus version 1.5g Description A Cross-Site Request Forgery CSRF issue exists, allowing unauthorized actions via the password parameter to "admin.php" in an "a=config" action. Recommendations For version 1.5g, consider restricting access t...

CVE-2017-9836: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Piwigo 2.9.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the virtualname parameter to /admin.php i.e., creating a virtual album...

PT-2017-19208

Name of the Vulnerable Software and Affected Versions Piwigo version 2.9.1 Description A cross-site scripting XSS issue allows remote authenticated administrators to inject arbitrary web script or HTML via the virtual name parameter to "/admin.php" when creating a virtual album. Recommendations F...

PT-2017-18914

Name of the Vulnerable Software and Affected Versions Event List plugin version 0.7.8 Description The issue allows an authenticated user to execute arbitrary SQL commands. This is achieved via the id parameter to the "wp-admin/admin.php" endpoint. Recommendations For Event List plugin version...

CVE-2017-9429: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress allows an authenticated user to execute arbitrary SQL commands via the id parameter to wp-admin/admin.php...

Sql injection

SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php...

CVE-2017-9418

SQL injection vulnerability in the WP-Testimonials plugin 3.4.1 for WordPress allows an authenticated user to execute arbitrary SQL commands via the testid parameter to wp-admin/admin.php...

CVE-2017-9548

admin.php in BigTree through 4.2.18 has a Cross-site Scripting XSS vulnerability, which allows remote authenticated users to inject arbitrary web script or HTML by launching a Home Template Edit Page action and entering the Navigation Title of a page that is scheduled for future publication aka a...

Design/Logic Flaw

admin.php in BigTree through 4.2.18 allows remote authenticated users to cause a denial of service inability to save revisions via XSS sequences in a revision name...

CVE-2017-9547

admin.php in BigTree through 4.2.18 has a Cross-site Scripting XSS vulnerability, which allows remote authenticated users to inject arbitrary web script or HTML by launching an Edit Page action and entering the Navigation Title or Page Title of a page that is scheduled for future publication aka ...