2954 matches found
PT-2018-14337
Name of the Vulnerable Software and Affected Versions Waimai Super Cms version 20150505 Description A security issue exists due to the presence of a cross-site scripting XSS flaw. This issue can be exploited via the fname parameter in the admin.php?m=Food&a=addsave or admin.php?m=Food&a=editsave...
PT-2018-14353
Name of the Vulnerable Software and Affected Versions FineCms version 5.4 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to modify the administrator's password through the "/admin.php?c=member&m=edit&uid=1" endpoint. Recommendations For FineCms version 5.4, ...
CVE-2018-18082: Improper Neutralization of Input During Web Page Generation
XSS exists in Waimai Super Cms 20150505 via the fname parameter to the admin.php?m=Food&a=addsave or admin.php?m=Food&a=editsave URI...
CVE-2018-18191: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in /admin.php?c=member&m=edit&uid=1 in dayrui FineCms 5.4 allows remote attackers to change the administrator's password...
CVE-2018-18069
processforms in the WPML aka sitepress-multilingual-cms plugin through 3.6.3 for WordPress has XSS via any localefilename parameter such as localefilenameen in an authenticated theme-localization.php request to wp-admin/admin.php...
CVE-2018-18069: Improper Neutralization of Input During Web Page Generation
processforms in the WPML aka sitepress-multilingual-cms plugin through 3.6.3 for WordPress has XSS via any localefilename parameter such as localefilenameen in an authenticated theme-localization.php request to wp-admin/admin.php...
CVE-2018-17826
HisiPHP 1.0.8 is vulnerable to CSRF via admin.php/admin/user/adduser.html, enabling an attacker to create an administrator account. This account can then leverage app/common/model/AdminAnnex.php to add .php to the allowed file-upload types list (.jpg, .png, .gif, .jpeg, .ico), facilitating arbitr...
CVE-2018-17826: Cross-Site Request Forgery (CSRF)
HisiPHP 1.0.8 allows CSRF via admin.php/admin/user/adduser.html to add an administrator account. The attacker can then use that account to execute arbitrary PHP code by leveraging app/common/model/AdminAnnex.php to add .php to the default list of allowable file-upload types .jpg, .png, .gif, .jpe...
PT-2018-14206
Name of the Vulnerable Software and Affected Versions HisiPHP version 1.0.8 Description The issue allows for a CSRF attack via the "admin.php/admin/user/adduser.html" API endpoint to add an administrator account. An attacker can then use this account to execute arbitrary PHP code by modifying the...
PT-2018-13920
Name of the Vulnerable Software and Affected Versions Quizlord plugin versions prior to 2.1 Description The issue allows for Stored XSS attacks through the title parameter in a ql insert action to "wp-admin/admin.php". Recommendations For Quizlord plugin versions prior to 2.1, update to version 2...
CVE-2018-17140: Improper Neutralization of Input During Web Page Generation
The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a qlinsert action to wp-admin/admin.php...
CVE-2018-16729
Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages-manage under admin.php?action=files...
CVE-2018-16729
Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages-manage under admin.php?action=files...
CVE-2018-16729
Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages-manage under admin.php?action=files...
CVE-2018-16729
Pluck CMS 4.7.7 is vulnerable to cross-site scripting via an SVG file containing Javascript in a SCRIPT element, uploaded through pages->manage under admin.php?action=files. The flaw is caused by how SVGs are handled, enabling XSS. Exploitation details are not provided in the documents; no pat...
PT-2018-13706
Name of the Vulnerable Software and Affected Versions Pluck version 4.7.7 Description The issue allows for XSS Cross-Site Scripting attacks via an SVG file containing Javascript in a SCRIPT element. This file can be uploaded through the 'pages-manage' section under the 'admin.php?action=files'...
CVE-2018-16729: Improper Neutralization of Input During Web Page Generation
Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages-manage under admin.php?action=files...
bloggen.be XSS vulnerability
Open Bug Bounty ID: OBB-674630 Description| Value ---|--- Affected Website:| bloggen.be Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
