CVE-2019-9052

An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures via a /admin.php?action=deleteimage&var1= URI...

CVE-2019-9051

An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete articles via a /admin.php?action=deletepage&var1= URI...

PT-2019-19334

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.9-dev1 Description A CSRF issue allows deletion of modules via the "/admin.php?action=module delete&var1=" API endpoint, where var1 is a vulnerable parameter. This can be exploited to delete modules. Recommendations For Pluck...

CVE-2019-9049: Cross-Site Request Forgery (CSRF)

An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete modules via a /admin.php?action=moduledelete&var1= URI...

CVE-2019-9051: Cross-Site Request Forgery (CSRF)

An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete articles via a /admin.php?action=deletepage&var1= URI...

PT-2019-19333

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.9-dev1 Description A CSRF issue allows deletion of a theme via the "/admin.php?action=theme delete&var1=" API endpoint. Recommendations For Pluck version 4.7.9-dev1, as a temporary workaround, consider restricting access to t...

PT-2019-19337

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.9-dev1 Description An issue was discovered that allows for a CSRF vulnerability, enabling the deletion of pictures via the "/admin.php?action=deleteimage&var1=" URI. Recommendations For Pluck version 4.7.9-dev1, consider...

CVE-2019-9048: Cross-Site Request Forgery (CSRF)

An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete a theme aka topic via a /admin.php?action=themedelete&var1= URI...

CVE-2019-9052: Cross-Site Request Forgery (CSRF)

An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures via a /admin.php?action=deleteimage&var1= URI...

Sql injection

Bo-blog Wind through 1.6.0-r allows SQL Injection via the admin.php/comments/batchdel/ comID parameter because this parameter is mishandled in the mode/admin.mode.php delBlockedBatch function...

CVE-2019-7587

Bo-blog Wind through 1.6.0-r allows SQL Injection via the admin.php/comments/batchdel/ comID parameter because this parameter is mishandled in the mode/admin.mode.php delBlockedBatch function...

CVE-2019-7587

CVE-2019-7587 affects Bo-blog Wind through 1.6.0-r. The vulnerability is a SQL Injection in the admin.php/comments/batchdel/ comID parameter, caused by mishandling in the mode/admin.mode.php delBlockedBatch function. The connected sources corroborate the issue and describe it as a SQL injection v...

Cross site scripting

An issue was discovered in Waimai Super Cms 20150505. admin.php?m=Member&a=adminaddsave has XSS via the username or password parameter...

CVE-2019-7570

A CSRF vulnerability was found in PbootCMS v1.3.6 that can delete users via an admin.php/User/del/ucode/ URI...

CVE-2019-7569

DOYO (doyocms) 2.3 (20140425 update) contains a CSRF vulnerability that can add a super administrator account via admin.php?c=a_adminuser&a=add&run=1. The affected component is the web admin interface; the issue enables privilege elevation by creating a new admin user. The connected documents con...

CVE-2019-7569

An issue was discovered in DOYO aka doyocms 2.320140425 update. There is a CSRF vulnerability that can add a super administrator account via admin.php?c=aadminuser&a=add&run=1...

CVE-2019-7570

CVE-2019-7570 applies to PbootCMS v1.3.6, describing a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to delete user accounts via the admin.php/User/del/ucode/ endpoint. The connected sources confirm the affected product/version and the targeted action, with no additional...

PT-2019-18653

Name of the Vulnerable Software and Affected Versions PbootCMS version 1.3.6 Description A CSRF issue was discovered that can lead to the deletion of users. This occurs via the "admin.php/User/del/ucode/" API endpoint. Recommendations For PbootCMS version 1.3.6, consider disabling access to the...

CVE-2019-7569: Cross-Site Request Forgery (CSRF)

An issue was discovered in DOYO aka doyocms 2.320140425 update. There is a CSRF vulnerability that can add a super administrator account via admin.php?c=aadminuser&a=add&run=1...

PT-2019-18650

Name of the Vulnerable Software and Affected Versions Waimai Super Cms version 20150505 Description An issue was discovered that allows for XSS via the username or password parameter in the "admin.php?m=Member&a=adminaddsave" API endpoint. Recommendations For Waimai Super Cms version 20150505,...