2954 matches found
PT-2019-12080
Name of the Vulnerable Software and Affected Versions UKcms version 1.1.10 Description A CSRF issue was discovered that can add an admin user. The issue is related to the "admin.php/admin/role/add.html" API endpoint. Recommendations For UKcms version 1.1.10, update to a newer version that contain...
Design/Logic Flaw
The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATHINFO...
CVE-2019-9912
The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATHINFO...
CVE-2019-9910
The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS...
CVE-2019-9912: Improper Neutralization of Input During Web Page Generation
The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATHINFO...
CVE-2019-9914: Improper Neutralization of Input During Web Page Generation
The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes pollid XSS...
CVE-2019-9913: Improper Neutralization of Input During Web Page Generation
The wp-live-chat-support plugin before 8.0.18 for WordPress has wp-admin/admin.php?page=wplivechat-menu-gdpr-page term XSS...
PT-2019-19932
Name of the Vulnerable Software and Affected Versions yop-poll plugin versions prior to 6.0.3 Description The issue affects the yop-poll plugin, allowing for XSS through the poll id parameter in the "view-votes" action, accessible via the /wp-admin/admin.php?page=yop-polls&action=view-votes...
CVE-2019-9911: Improper Neutralization of Input During Web Page Generation
The social-networks-auto-poster-facebook-twitter-g plugin before 4.2.8 for WordPress has wp-admin/admin.php?page=nxssnap-reposter&action=edit item XSS...
CVE-2019-9910: Improper Neutralization of Input During Web Page Generation
The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS...
CVE-2018-18845: Improper Neutralization of Input During Web Page Generation
internal/advancedcommentsystem/index.php and internal/advancedcommentsystem/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACSpath. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTM...
CVE-2019-9646
The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cpadminintedition.inc.php in the "custom edition area."...
CVE-2019-9646: Improper Neutralization of Input During Web Page Generation
The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cpadminintedition.inc.php in the "custom edition area."...
Cross site request forgery (csrf)
An issue was discovered in Cscms 4.1.0. There is an admin.php/pay CSRF vulnerability that can change the payment account to redirect funds...
CVE-2019-9598
An issue was discovered in Cscms 4.1.0. There is an admin.php/pay CSRF vulnerability that can change the payment account to redirect funds...
CVE-2019-9598
The CVE-2019-9598 entry describes a CSRF vulnerability in Cscms 4.1.0, specifically in the admin.php/pay flow, that allows an attacker to change the payment account and redirect funds. Documents confirm affected software (Cscms 4.1.0) and the vulnerability class (CSRF) with the underlying impact ...
PT-2019-19738
Name of the Vulnerable Software and Affected Versions Cscms version 4.1.0 Description An issue in Cscms allows for a CSRF vulnerability through the admin.php/pay endpoint, potentially enabling an attacker to change the payment account and redirect funds. Recommendations For Cscms version 4.1.0, a...
CVE-2019-9598: Cross-Site Request Forgery (CSRF)
An issue was discovered in Cscms 4.1.0. There is an admin.php/pay CSRF vulnerability that can change the payment account to redirect funds...
Unrestricted file upload
SchoolCMS version 2.3.1 allows file upload via the theme upload feature at admin.php?m=admin&c=theme&a=upload by using the .zip extension along with the Static substring, changing the Content-Type to application/zip, and placing PHP code after the ZIP header. This ultimately allows execution of...
CVE-2019-9572
SchoolCMS version 2.3.1 allows file upload via the theme upload feature at admin.php?m=admin&c=theme&a=upload by using the .zip extension along with the Static substring, changing the Content-Type to application/zip, and placing PHP code after the ZIP header. This ultimately allows execution of...