2950 matches found
CVE-2019-14679: Cross-Site Request Forgery (CSRF)
core/views/arpriceimportexport.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arpliteimportexport CSRF...
CVE-2015-9292: Cross-Site Request Forgery (CSRF)
6kbbs 7.1 and 8.0 allows CSRF via portalchannelajax.php id or code parameter or admin.php fileids parameter...
CVE-2019-14774: Improper Neutralization of Input During Web Page Generation
The woo-variation-swatches aka Variation Swatches for WooCommerce plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter...
PT-2019-5819
Name of the Vulnerable Software and Affected Versions ARPrice Lite plugin version 2.2 for WordPress Description The issue is related to insufficient protection against CSRF requests in the ARPrice Lite plugin for WordPress. This can allow a remote attacker to perform a CSRF attack. The specific...
PT-2019-7251
Name of the Vulnerable Software and Affected Versions 6kbbs versions 7.1 through 8.0 Description The issue allows for CSRF attacks via specific API endpoints, including "portalchannel ajax.php" with id or code parameters, and "admin.php" with a fileids parameter. Recommendations For versions 7.1...
CVE-2018-14831: Exposure of Sensitive Information to an Unauthorized Actor
An arbitrary file read vulnerability in DamiCMS v6.0.0 allows remote authenticated administrators to read any files in the server via a crafted /admin.php?s=Tpl/Add/id/ URI...
PT-2019-9054
Name of the Vulnerable Software and Affected Versions DamiCMS version 6.0.0 Description The issue allows remote authenticated administrators to read any files on the server by crafting a specific URI, /admin.php?s=Tpl/Add/id/. This is an arbitrary file read vulnerability. Recommendations For...
PT-2019-13279
Name of the Vulnerable Software and Affected Versions CRUDLab WP Like Button plugin versions prior to 1.6.1 Description The issue allows unauthenticated attackers to change settings due to an authentication bypass. The contains function in wp like button.php did not check if the current request i...
CVE-2018-19461
admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php...
CVE-2018-19461
admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php...
CVE-2018-19461: Improper Neutralization of Input During Web Page Generation
admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php...
PT-2019-9824
Name of the Vulnerable Software and Affected Versions EmpireCMS versions through 7.5 Description The issue allows remote attackers to execute arbitrary PHP code via SQL injection. This is achieved by using a .php filename in a SELECT INTO OUTFILE statement to admin/admin.php. Recommendations For...
PT-2019-9823
Name of the Vulnerable Software and Affected Versions EmpireCMS versions through 7.5 Description The issue allows for XSS via crafted SQL syntax to the admin/admin.php endpoint. This is achieved by exploiting the admindbDoSql.php file in EmpireCMS. Recommendations For EmpireCMS versions through...
CVE-2018-18872: Improper Neutralization of Input During Web Page Generation
The Kieran O'Shea Calendar plugin before 1.3.11 for WordPress has Stored XSS via the eventtitle parameter in a wp-admin/admin.php?page=calendar add action, or the category name during category creation at the wp-admin/admin.php?page=calendar-categories URI...
Information disclosure
doorGets 7.0 has a sensitive information disclosure vulnerability in /setup/temp/admin.php and /setup/temp/database.php. A remote unauthenticated attacker could exploit this vulnerability to obtain the administrator password...
CVE-2019-11616
CVE-2019-11616 affects doorGets 7.0. The vulnerability is a sensitive information disclosure in /setup/temp/admin.php and /setup/temp/database.php, allowing a remote unauthenticated attacker to obtain the administrator password. Affected software: doorGets 7.0 (web CMS). Root cause and vector det...
CVE-2019-11616: Undefined Security Weakness
doorGets 7.0 has a sensitive information disclosure vulnerability in /setup/temp/admin.php and /setup/temp/database.php. A remote unauthenticated attacker could exploit this vulnerability to obtain the administrator password...
PT-2019-12423
Name of the Vulnerable Software and Affected Versions doorGets version 7.0 Description The issue allows a remote unauthenticated attacker to disclose sensitive information. Specifically, the vulnerability is present in the /setup/temp/admin.php and /setup/temp/database.php API endpoints, which...
