2954 matches found
PT-2019-18277
Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description The issue is related to SQL injection via the admin.php?mod=order API endpoint, specifically through the state parameter. Recommendations For PHPSHE version 1.7, consider restricting access to the...
PT-2019-18276
Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description The issue is related to SQL injection. It occurs via the admin.php?mod=product&act=state API endpoint, specifically through the product id parameter. Recommendations For PHPSHE version 1.7, consider restricting...
CVE-2019-6708: Improper Neutralization of Special Elements used in an SQL Command
PHPSHE 1.7 has SQL injection via the admin.php?mod=order state parameter...
PT-2019-18272
Name of the Vulnerable Software and Affected Versions phpwind version 9.0.2.170426 Description The issue allows SQL Injection via the admin.php?m=backup&c=backup&a=doback endpoint, specifically through the tabledb parameter, related to the "--backup database" option. Recommendations For phpwind...
CVE-2019-6691: Improper Neutralization of Special Elements used in an SQL Command
phpwind 9.0.2.170426 UTF8 allows SQL Injection via the admin.php?m=backup&c=backup&a=doback tabledb parameter, related to the "--backup database" option...
CVE-2016-10737
Serendipity 2.0.4 has XSS via the serendipityadmin.php serendipitybody parameter...
PT-2019-7536
Name of the Vulnerable Software and Affected Versions Serendipity version 2.0.4 Description The issue is related to a security problem where an attacker can inject malicious code. The problem occurs via the serendipity admin.php endpoint, specifically through the serendipitybody parameter...
PT-2019-7535
Name of the Vulnerable Software and Affected Versions Social Pug - Easy Social Share Buttons plugin versions prior to 1.2.6 Description The issue allows for XSS via the dpsp message class parameter in the "wp-admin/admin.php?page=dpsp-toolkit" API endpoint. Recommendations For Social Pug - Easy...
CVE-2016-10736: Improper Neutralization of Input During Web Page Generation
The "Social Pug - Easy Social Share Buttons" plugin before 1.2.6 for WordPress allows XSS via the wp-admin/admin.php?page=dpsp-toolkit dpspmessageclass parameter...
Nextcloud: WordPress vulnerable to multiple attacks at https://nextcloud.com
summary: your current version of WordPress is available to multiple attacks check INFO.php available attacks: - Unauthenticated Arbitrary File Deletion - lib/IPTraf.php User-Agent Header Stored XSS - Password Creation Restriction Bypass - wp-admin/admin.php whois Parameter Stored XSS - XSS & IAA ...
CVE-2018-20603
Lei Feng TV CMS aka LFCMS 3.8.6 allows admin.php?s=/Member/add.html CSRF...
CVE-2018-20604: Improper Limitation of a Pathname to a Restricted Directory
Lei Feng TV CMS aka LFCMS 3.8.6 allows Directory Traversal via crafted use of .. in Template/edit/path URIs, as demonstrated by the admin.php?s=/Template/edit/path/web........1.txt.html URI to read the 1.txt file...
CVE-2018-20603: Cross-Site Request Forgery (CSRF)
Lei Feng TV CMS aka LFCMS 3.8.6 allows admin.php?s=/Member/add.html CSRF...
PT-2018-15467
Name of the Vulnerable Software and Affected Versions Lei Feng TV CMS aka LFCMS version 3.8.6 Description The issue allows for a CSRF attack on the admin.php?s=/Member/add.html endpoint. Recommendations For Lei Feng TV CMS aka LFCMS version 3.8.6, consider implementing CSRF protection measures,...
CVE-2018-20571
CVE-2018-20571 affects DamiCMS 6.0.1. An attacker can remotely read arbitrary files by sending a crafted request to admin.php?s=Tpl/Add/id, demonstrated by reading the global configuration file at .\Public\Config\config.ini.php. The underlying issue is an arbitrary file read path handling in the ...
PT-2018-15441
Name of the Vulnerable Software and Affected Versions DamiCMS version 6.0.1 Description The issue allows remote attackers to read arbitrary files by sending a crafted request to the admin.php?s=Tpl/Add/id endpoint. For example, an attacker can read the global configuration file by accessing...
CVE-2018-20571: Exposure of Sensitive Information to an Unauthorized Actor
DamiCMS 6.0.1 allows remote attackers to read arbitrary files via a crafted admin.php?s=Tpl/Add/id request, as demonstrated by admin.php?s=Tpl/Add/id/.\Public\Config\config.ini.php to read the global configuration file...
Design/Logic Flaw
Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...
