PT-2018-15038

Name of the Vulnerable Software and Affected Versions tp5cms versions prior to 2017-05-25 Description An issue allows remote attackers to execute arbitrary PHP code by uploading a .php file with the content type set to image/jpeg to the "admin.php/upload/picture.html" endpoint. Recommendations Fo...

Cross site request forgery (csrf)

sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account...

CVE-2018-19561

sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account...

CVE-2018-19561

Affected software: sikcms version 1.1. Vulnerability: Cross-Site Request Forgery (CSRF) in admin.php?m=Admin&c=Users&a=userAdd that allows an attacker to add an administrator account. Root cause/impact: CSRF enables unauthorized privilege escalation by creating an admin account. Exploitation deta...

PT-2018-15006

Name of the Vulnerable Software and Affected Versions sikcms version 1.1 Description The issue allows for CSRF via the "admin.php?m=Admin&c=Users&a=userAdd" endpoint to add an administrator account. Recommendations For version 1.1, as a temporary workaround, consider disabling access to the...

PT-2018-15007

Name of the Vulnerable Software and Affected Versions PHPok version 4.9.015 Description An issue was discovered that allows remote attackers to execute arbitrary code. This is achieved through the "Login Background Program Upgrade Compressed Packet Upgrade" action, where a .php file is placed...

CVE-2018-19561: Cross-Site Request Forgery (CSRF)

sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account...

CVE-2018-19562: Unrestricted Upload of File with Dangerous Type

An issue was discovered in PHPok 4.9.015. admin.php?c=update&f=unzip allows remote attackers to execute arbitrary code via a "Login Background Program Upgrade Compressed Packet Upgrade" action in which a .php file is inside a ZIP archive...

Code injection

Discuz! X3.4 allows XSS via admin.php because admincp/admincpsetting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code...

CVE-2018-19464

Discuz! X3.4 allows XSS via admin.php because admincp/admincpsetting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code...

CVE-2018-19464

Discuz! X3.4 allows XSS via admin.php because admincp/admincpsetting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code...

CVE-2018-19464

The vulnerability concerns Discuz! X3.4 where an XSS flaw can be triggered via admin.php due to improper handling of the statcode field in admincp/admincp_setting.php and template\default\common\footer.htm. The root cause is mishandling of third-party stats code, enabling injection of arbitrary w...

PT-2018-14969

Name of the Vulnerable Software and Affected Versions Discuz! X3.4 Description The issue arises from the mishandling of the statcode field from third-party stats code in admincp/admincp setting.php and templatedefaultcommonfooter.htm, allowing for XSS via admin.php. Recommendations For Discuz!...

CVE-2018-19464: Improper Neutralization of Input During Web Page Generation

Discuz! X3.4 allows XSS via admin.php because admincp/admincpsetting.php and template\default\common\footer.htm mishandles statcode field from third-party stats code...

Cross site request forgery (csrf)

SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=gifts&a=update to change goods prices with the super administrator's privileges...

Cross site request forgery (csrf)

SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account...

CVE-2018-19318

SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account...

CVE-2018-19318

The CVE-2018-19318 issue affects SRCMS 3.0.0 and is a CSRF vulnerability that can be exploited via admin.php?m=Admin&c=manager&a=update to alter the super administrator’s username and password. Root cause: CSRF on the admin update endpoint allows unauthorized change of credentials. Impact: compro...

CVE-2018-19318

SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account...

CVE-2018-19319

SRCMS 3.0.0 contains a CSRF vulnerability that allows an attacker to change product prices via admin.php?m=Admin&c=gifts&a=update, exploiting the super administrator’s privileges. The issue arises from lack of proper CSRF protection for admin actions, enabling unauthorized price modification. Doc...