CVE-2018-16633

Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...

CVE-2018-16633

Pluck v4.7.7 contains a cross-site scripting (XSS) vulnerability that can be triggered via the page title when editing a page (admin.php?action=editpage&page=...). The underlying issue is a lack of proper sanitization/escaping for the title parameter, enabling injection of malicious scripts. The ...

CVE-2018-16633

Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...

CVE-2018-16634

The vulnerability CVE-2018-16634 affects the Pluck CMS v4.7.7. A Cross-Site Request Forgery (CSRF) exists that allows an attacker to perform unauthorized actions via admin.php?action=settings, such as changing site name and email parameters. This is documented in CNVD-2018-25041 (Pluck CSRF vulne...

CVE-2018-19853

An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability that allows control over the whole web site via the admin.php/user/add URI because a storekeeper account which is supposed to have only privileges for commodity management can add an...

CVE-2018-19853

An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability that allows control over the whole web site via the admin.php/user/add URI because a storekeeper account which is supposed to have only privileges for commodity management can add an...

CVE-2018-19853

CVE-2018-19853 describes an elevation-of-privilege flaw in hitshop (through 2014-07-15) where a storekeeper account can add an administrator via admin.php/user/add, gaining control of the whole site. Affected component: the web application’s user/add workflow; root cause: storekeeper privileges c...

CVE-2018-19853

An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability that allows control over the whole web site via the admin.php/user/add URI because a storekeeper account which is supposed to have only privileges for commodity management can add an...

PT-2018-13660

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.7 Description The issue allows for XSS via the admin.php?action=editpage&page= endpoint, specifically the page parameter. This can be exploited by manipulating the page title. Recommendations For Pluck version 4.7.7, consider...

PT-2018-13661

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.7 Description The issue allows for CSRF via the admin.php?action=settings endpoint. This can potentially be exploited by tricking an administrator into performing unintended actions. Recommendations For Pluck version 4.7.7,...

PT-2018-15129

Name of the Vulnerable Software and Affected Versions hitshop versions prior to 2014-07-15 Description An issue was discovered that allows for elevation-of-privilege, enabling control over the whole website. This is achieved via the "admin.php/user/add" URI, where a storekeeper account, intended...

CVE-2018-16633: Improper Neutralization of Input During Web Page Generation

Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...

CVE-2018-19853: Improper Privilege Management

An issue was discovered in hitshop through 2014-07-15. There is an elevation-of-privilege vulnerability that allows control over the whole web site via the admin.php/user/add URI because a storekeeper account which is supposed to have only privileges for commodity management can add an...

CVE-2018-16634: Cross-Site Request Forgery (CSRF)

Pluck v4.7.7 allows CSRF via admin.php?action=settings...

CVE-2018-19693

An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the title parameter...

Design/Logic Flaw

An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the title parameter...

PT-2018-15039

Name of the Vulnerable Software and Affected Versions tp5cms versions prior to 2017-05-25 Description An issue was discovered that allows for XSS via the title parameter in the "admin.php/system/set.html" API endpoint. Recommendations For versions prior to 2017-05-25, as a temporary workaround,...

PT-2018-15038

Name of the Vulnerable Software and Affected Versions tp5cms versions prior to 2017-05-25 Description An issue allows remote attackers to execute arbitrary PHP code by uploading a .php file with the content type set to image/jpeg to the "admin.php/upload/picture.html" endpoint. Recommendations Fo...

CVE-2018-19692: Unrestricted Upload of File with Dangerous Type

An issue was discovered in tp5cms through 2017-05-25. admin.php/upload/picture.html allows remote attackers to execute arbitrary PHP code by uploading a .php file with the image/jpeg content type...

CVE-2018-18619: Improper Neutralization of Special Elements used in an SQL Command

internal/advancedcommentsystem/admin.php in Advanced Comment System 1.0 is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query, allowing remote attackers to execute the sqli attack via a URL in the "page" parameter...