2954 matches found
PT-2019-18652
Name of the Vulnerable Software and Affected Versions doyocms version 2.320140425 update Description An issue was discovered that allows for a CSRF vulnerability, enabling the addition of a super administrator account via the "admin.php?c=a adminuser&a=add&run=1" endpoint. The c, a, and run...
PT-2019-18659
Name of the Vulnerable Software and Affected Versions Bo-blog Wind versions through 1.6.0-r Description The issue allows SQL Injection via the comID parameter in the "admin.php/comments/batchdel/" endpoint because this parameter is mishandled in the delBlockedBatch function in mode/admin.mode.php...
CVE-2019-7567: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Waimai Super Cms 20150505. admin.php?m=Member&a=adminaddsave has XSS via the username or password parameter...
CVE-2019-7570: Cross-Site Request Forgery (CSRF)
A CSRF vulnerability was found in PbootCMS v1.3.6 that can delete users via an admin.php/User/del/ucode/ URI...
CVE-2019-7587: Improper Neutralization of Special Elements used in an SQL Command
Bo-blog Wind through 1.6.0-r allows SQL Injection via the admin.php/comments/batchdel/ comID parameter because this parameter is mishandled in the mode/admin.mode.php delBlockedBatch function...
Cross site request forgery (csrf)
Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links...
CVE-2019-6779
CVE-2019-6779 affects CSCMS 4.1.8. The vulnerability is a CSRF flaw on the admin.php/links/save endpoint, enabling an attacker to add, modify, or delete friend links without providing proper authorization. Root cause stated is lack of CSRF protection on that admin action; exploitation details are...
CVE-2019-6779
Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links...
ImpressCMS 1.3.11 SQL Injection
Title: ImpressCMS 1.3.11 - 'bid' SQL Injection Date: 21.01.2019 Exploit Author: Mehmet Onder Key Vendor Homepage: http://www.impresscms.org/ Software Link: https://sourceforge.net/projects/impresscms/files/v1.3.11/impresscms1.3.11.zip Version: v1.3.11 Category: Webapps Tested on: WAMPP @Win...
PT-2019-18338
Name of the Vulnerable Software and Affected Versions Cscms version 4.1.8 Description The issue allows for a CSRF attack on the "admin.php/links/save" endpoint to add, modify, or delete friend links. Recommendations For version 4.1.8, update to a newer version that includes a fix for this issue, ...
CVE-2019-6779: Cross-Site Request Forgery (CSRF)
Cscms 4.1.8 allows admin.php/links/save CSRF to add, modify, or delete friend links...
CVE-2019-6708
PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...
Sql injection
PHPSHE 1.7 has SQL injection via the admin.php?mod=product&act=state productid parameter...
Sql injection
PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...
CVE-2019-6708
PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...
CVE-2019-6707
CVE-2019-6707 affects PHPSHE 1.7 and is a SQL injection vulnerability in the admin interface. The injection targets the product_id[] parameter via admin.php?mod=product&act=state, enabling manipulation of the underlying database according to the description. The connected sources confirm the vuln...
CVE-2019-6708
PHPSHE 1.7 contains a SQL injection vulnerability via the admin.php?mod=order state parameter. The Connected documents confirm the vulnerability but do not include explicit impact details, exploit information, or remediation.
Sql injection
phpwind 9.0.2.170426 UTF8 allows SQL Injection via the admin.php?m=backup&c=backup&a=doback tabledb parameter, related to the "--backup database" option...