2954 matches found
Design/Logic Flaw
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...
CVE-2018-18432
An issue was discovered in DESTOON B2B 7.0. CSRF exists via the admin.php URI in an action=add request...
CVE-2018-18431
DESTOON B2B 7.0 contains a cross-site scripting (XSS) vulnerability exposed via text boxes when visiting admin.php?moduleid=2&action=add. The CVE entry and CNVD/NVD variants describe the same issue, with no explicit details on affected build flavors beyond version 7.0 and the vulnerable input poi...
CVE-2018-18432
Summary: DESTOON B2B 7.0 is affected by a CSRF vulnerability that can be exploited via the admin.php URI with an action=add request. Multiple sources (NVD entry CVE-2018-18432 and CNVD/NVD references) confirm a CSRF flaw in DESTOON B2B 7.0. The CVSS metrics indicate a network-based, high-severity...
CVE-2018-18431
An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI...
CVE-2018-18430
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...
PT-2018-14459
Name of the Vulnerable Software and Affected Versions DESTOON B2B version 7.0 Description An issue was discovered in the software, where the categorycatname parameter in the "admin.php" URI is vulnerable to XSS. This occurs in the "admin/category.inc.php" file. Recommendations For DESTOON B2B...
PT-2018-14467
Name of the Vulnerable Software and Affected Versions PbootCMS versions prior to V1.3.0 Description The issue is related to SQL Injection in the SingleController.php file. It can be exploited by sending POST data to the "admin.php/Single/mod/mcode/1/id/3" API endpoint. Recommendations For version...
PT-2018-14458
Name of the Vulnerable Software and Affected Versions DESTOON B2B version 7.0 Description An issue exists where CSRF is possible via the "admin.php" URI in an "action=add" request. Recommendations For DESTOON B2B version 7.0, consider implementing CSRF protection mechanisms, such as tokens, to...
PT-2018-14456
Name of the Vulnerable Software and Affected Versions DESTOON B2B version 7.0 Description An issue was discovered in the software, where the adminsetting.inc.php file has a cross-site scripting XSS vulnerability via the first text box to the admin.php URI. Recommendations For DESTOON B2B version...
PT-2018-14457
Name of the Vulnerable Software and Affected Versions DESTOON B2B version 7.0 Description An issue exists where XSS is possible via certain text boxes to the "admin.php?moduleid=2&action=add" URI. Recommendations For DESTOON B2B version 7.0, consider restricting access to the admin.php module to...
CVE-2018-18433: Improper Neutralization of Input During Web Page Generation
An issue was discovered in DESTOON B2B 7.0. admin/category.inc.php has XSS via the categorycatname parameter to the admin.php URI...
CVE-2018-18450: Improper Neutralization of Special Elements used in an SQL Command
apps\admin\controller\content\SingleController.php in PbootCMS before V1.3.0 build 2018-11-12 has SQL Injection, as demonstrated by the POST data to the admin.php/Single/mod/mcode/1/id/3 URI...
CVE-2018-18430: Improper Neutralization of Input During Web Page Generation
An issue was discovered in DESTOON B2B 7.0. admin\setting.inc.php has XSS via the first text box to the admin.php URI...
CVE-2018-18431: Improper Neutralization of Input During Web Page Generation
An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI...
CVE-2018-18432: Cross-Site Request Forgery (CSRF)
An issue was discovered in DESTOON B2B 7.0. CSRF exists via the admin.php URI in an action=add request...
PT-2018-14427
Name of the Vulnerable Software and Affected Versions Z-BlogPHP version 1.5.2.1935 Description The issue is related to a stored XSS vulnerability. It occurs in the zb system/function/c system admin.php file via the Content-Type header when uploading image attachments. Recommendations For Z-BlogPH...
CVE-2018-18191
CVE-2018-18191 describes a Cross‑Site Request Forgery (CSRF) vulnerability in Dayrui FineCms 5.4, specifically in /admin.php?c=member&m=edit&uid=1, which allows remote attackers to change the administrator’s password. The connected documents confirm the affected product/version and the vulnerable...
