2954 matches found
PT-2018-14914
Name of the Vulnerable Software and Affected Versions SRCMS version 3.0.0 Description The issue allows for a CSRF attack via the "admin.php?m=Admin&c=manager&a=update" endpoint to change the username and password of the super administrator account. Recommendations For SRCMS version 3.0.0, update ...
CVE-2018-19319: Cross-Site Request Forgery (CSRF)
SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=gifts&a=update to change goods prices with the super administrator's privileges...
CVE-2018-19318: Cross-Site Request Forgery (CSRF)
SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account...
PT-2018-14915
Name of the Vulnerable Software and Affected Versions SRCMS version 3.0.0 Description The issue allows for a CSRF attack via the "admin.php?m=Admin&c=gifts&a=update" API endpoint to change goods prices with the privileges of a super administrator. Recommendations For SRCMS version 3.0.0, as a...
CVE-2018-18380
A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session...
CVE-2018-18380
A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session...
CVE-2018-18380
CVE-2018-18380 affects BigTree (Bigtree) CMS prior to 4.2.24. The admin.php flow accepts a user-supplied PHP session ID after login instead of regenerating a new one, enabling session hijacking (session fixation). Documents indicate this is fixed in 4.2.24; remediation is to upgrade to 4.2.24 or ...
CVE-2018-18380: Session Fixation
A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session...
CVE-2018-18486
An issue was discovered in PHPSHE 1.7. SQL injection exists via the admin.php?mod=user&act=del userid parameter...
Sql injection
An issue was discovered in PHPSHE 1.7. SQL injection exists via the admin.php?mod=user&act=del userid parameter...
CVE-2018-18486
An issue was discovered in PHPSHE 1.7. SQL injection exists via the admin.php?mod=user&act=del userid parameter...
Design/Logic Flaw
XSS exists in the wp-live-chat-support v8.0.15 plugin for WordPress via the modules/gdpr.php term parameter in a wp-admin/admin.php wplivechat-menu-gdpr-page request...
PT-2018-14486
Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description An issue exists in the software, allowing SQL injection via the "admin.php?mod=user&act=del" API endpoint, specifically through the user id parameter. Recommendations For PHPSHE version 1.7, avoid using the user ...
PT-2018-14485
Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description An issue was discovered that allows remote attackers to delete arbitrary files via directory traversal sequences in the dbname parameter in the "admin.php?mod=db&act=del" API endpoint. This can be leveraged to...
CVE-2018-18486: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in PHPSHE 1.7. SQL injection exists via the admin.php?mod=user&act=del userid parameter...
CVE-2018-18485: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in PHPSHE 1.7. admin.php?mod=db&act=del allows remote attackers to delete arbitrary files via directory traversal sequences in the dbname parameter. This can be leveraged to reload the product by deleting install.lock...
CVE-2018-18430
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...
CVE-2018-18431
An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI...