CVE-2019-9576: Improper Neutralization of Input During Web Page Generation

The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS...

PT-2019-19721

Name of the Vulnerable Software and Affected Versions Blog2Social plugin versions prior to 5.0.3 Description The issue allows for XSS in the wp-admin/admin.php?page=blog2social-ship API endpoint. No information is provided about the estimated number of potentially affected devices or real-world...

PT-2019-19720

Name of the Vulnerable Software and Affected Versions The Quiz And Survey Master plugin version 6.0.4 Description The issue allows for a quiz id XSS in the wp-admin/admin.php?page=mlw quiz results page. Recommendations For The Quiz And Survey Master plugin version 6.0.4, update to a newer version...

CVE-2019-9575: Improper Neutralization of Input During Web Page Generation

The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlwquizresults quizid XSS...

CVE-2019-9572: Unrestricted Upload of File with Dangerous Type

SchoolCMS version 2.3.1 allows file upload via the theme upload feature at admin.php?m=admin&c=theme&a=upload by using the .zip extension along with the Static substring, changing the Content-Type to application/zip, and placing PHP code after the ZIP header. This ultimately allows execution of...

Cross site scripting

An issue was discovered in DOYO aka doyocms 2.3 through 2015-05-06. It has admin.php XSS...

CVE-2019-9551

An issue was discovered in DOYO aka doyocms 2.3 through 2015-05-06. It has admin.php XSS...

CVE-2019-9551

An issue was discovered in DOYO aka doyocms 2.3 through 2015-05-06. It has admin.php XSS...

CVE-2019-9551: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DOYO aka doyocms 2.3 through 2015-05-06. It has admin.php XSS...

CVE-2019-9568: Improper Neutralization of Special Elements used in an SQL Command

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry parameter if the attacker has the delete permission...

PT-2019-19702

Name of the Vulnerable Software and Affected Versions DOYO aka doyocms versions 2.3 through 2015-05-06 Description An issue was discovered in the software, which has an XSS vulnerability in the admin.php file. Recommendations For DOYO aka doyocms versions 2.3 through 2015-05-06, consider disablin...

Cross site scripting

DhCms through 2017-09-18 has admin.php?r=admin/Index/index XSS...

CVE-2019-9550

DhCms through 2017-09-18 has admin.php?r=admin/Index/index XSS...

CVE-2019-9550

CVE-2019-9550 affects DhCms (DhCms through 2017-09-18) with an XSS in admin.php?r=admin/Index/index. The root cause is a stored/reflected XSS in the admin backend, enabling an attacker to potentially obtain cookie information (per CNVD-2019-08720). Multiple sources (NVD, Red Hat, CNVD) report the...

PT-2019-19701

Name of the Vulnerable Software and Affected Versions DhCms through 2017-09-18 Description The issue is related to an XSS in the admin.php?r=admin/Index/index page. Recommendations For DhCms versions through 2017-09-18, update to a version released after 2017-09-18 to resolve the issue...

CVE-2019-9550: Improper Neutralization of Input During Web Page Generation

DhCms through 2017-09-18 has admin.php?r=admin/Index/index XSS...

CVE-2019-9181

CVE-2019-9181 affects SchoolCMS v2.3.1. The issue arises in the logo upload feature (admin.php?m=admin&c=site&a=save): an attacker can upload a file with a .jpg extension, set Content-Type to image/php, and append PHP code after the JPEG data, enabling arbitrary PHP code execution on the server. ...

CVE-2019-9181: Unrestricted Upload of File with Dangerous Type

SchoolCMS version 2.3.1 allows file upload via the logo upload feature at admin.php?m=admin&c=site&a=save by using the .jpg extension, changing the Content-Type to image/php, and placing PHP code after the JPEG data. This ultimately allows execution of arbitrary PHP code...

PT-2019-19419

Name of the Vulnerable Software and Affected Versions SchoolCMS version 2.3.1 Description The issue allows for file upload via the logo upload feature at "admin.php?m=admin&c=site&a=save" by manipulating the file extension and content type. Specifically, an attacker can use the .jpg extension,...

CVE-2019-9048

An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete a theme aka topic via a /admin.php?action=themedelete&var1= URI...