PT-2021-10413

Name of the Vulnerable Software and Affected Versions: DOYOCMS version 2.3 Description: A SQL injection issue in the admin.php file allows attackers to execute arbitrary SQL commands via the orders parameter. Recommendations: For DOYOCMS version 2.3, consider restricting access to the admin.php...

CVE-2020-19547

Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php...

CVE-2020-19547

Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php...

CVE-2020-18065

Cross Site Scripting XSS vulnerability exists in PopojiCMS 2.0.1 in admin.php?mod=menumanager--------- edit menu...

Directory traversal

Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php...

CVE-2020-19547

Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php...

CVE-2020-19547

Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php...

CVE-2020-19547

CVE-2020-19547 affects PopojiCMS 2.0.1, where a directory traversal vulnerability exists via the id parameter in admin.php. The issue is triggered over the network and is tied to an input path handling flaw in PopojiCMS’s admin interface, allowing potentially access to sensitive files. The connec...

CVE-2020-18065

CVE-2020-18065 affects PopojiCMS 2.0.1, specifically the admin.php?mod=menumanager functionality. The vulnerability is described as a Cross Site Scripting (XSS) issue; the connected documents do not provide technical details such as vulnerable function, input handling, or exploitation vectors. CV...

CVE-2020-18065

Cross Site Scripting XSS vulnerability exists in PopojiCMS 2.0.1 in admin.php?mod=menumanager--------- edit menu...

PT-2021-10122

Name of the Vulnerable Software and Affected Versions: PopojiCMS version 2.0.1 Description: A Cross Site Scripting XSS issue exists in the admin.php module, specifically when editing menus through the mod=menumanager parameter. This allows for potential malicious script execution. Recommendations...

CVE-2020-19547: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php...

PT-2021-10366

Name of the Vulnerable Software and Affected Versions: PopojiCMS version 2.0.1 Description: A Directory Traversal issue exists via the id parameter in "admin.php". Recommendations: For PopojiCMS version 2.0.1, avoid using the id parameter in the "admin.php" endpoint until the issue is resolved...

CVE-2020-18065: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability exists in PopojiCMS 2.0.1 in admin.php?mod=menumanager--------- edit menu...

CVE-2021-39599

Multiple Cross Site Scripting XSS vulnerabilities exists in CXUUCMS 3.1 in the search and c parameters in 1 public/search.php and in the 2 c parameter in admin.php...

CVE-2021-39599

CVE-2021-39599 affects CXUUCMS 3.1, with multiple XSS vulnerabilities in public/search.php (search parameter) and admin.php (c parameter). The root cause is unsanitized input leading to client-side code execution. Impact is documented as XSS with potential impact on confidentiality/integrity depe...

PT-2021-22671

Name of the Vulnerable Software and Affected Versions: CXUUCMS version 3.1 Description: Multiple Cross Site Scripting XSS vulnerabilities exist in CXUUCMS. The vulnerabilities are found in the search and c parameters in "public/search.php" and in the c parameter in "admin.php". Recommendations: F...

CVE-2021-39599: Improper Neutralization of Input During Web Page Generation

Multiple Cross Site Scripting XSS vulnerabilities exists in CXUUCMS 3.1 in the search and c parameters in 1 public/search.php and in the 2 c parameter in admin.php...

Display users <= 2.0.0 - Authenticated SQL Injection

The Edit Role functionality in the plugin had an id parameter which is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. GET /wp-admin/admin.php?page=display-users&tab=manage-role&action=edit&id=-4476+UNION+ALL+SELECT+NULL%2Cuser%28%29%2CNULL--+-...

PT-2021-20620

Name of the Vulnerable Software and Affected Versions: Media Usage WordPress plugin versions up to and including 0.0.4 Description: The issue allows attackers to inject arbitrary web scripts via the id parameter in the /mmu admin.php file, enabling Reflected Cross-Site Scripting attacks...