PT-2018-13233

Name of the Vulnerable Software and Affected Versions DamiCMS version 6.0.0 Description An issue was discovered that allows revision of the administrator account's password via the "API Endpoint: /admin.php?s=/Admin/doedit" due to a CSRF vulnerability. Recommendations For DamiCMS version 6.0.0,...

CVE-2018-15844: Cross-Site Request Forgery (CSRF)

An issue was discovered in DamiCMS 6.0.0. There is an CSRF vulnerability that can revise the administrator account's password via /admin.php?s=/Admin/doedit...

CVE-2018-15570

In waimai Super Cms 20150505, there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter...

Cross site scripting

In waimai Super Cms 20150505, there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter...

CVE-2018-15568

tp5cms through 2017-05-25 has CSRF via admin.php/category/delete.html...

CVE-2018-15566

tp5cms through 2017-05-25 has XSS via the admin.php/article/index.html q parameter...

CVE-2018-15570

The CVE refers to CVE-2018-15570 affecting waimai Super Cms 20150505, with a stored XSS in the /admin.php/Foodcat/editsave fcname parameter. The available connected sources confirm the vulnerability type (stored XSS) and the affected component/parameter, but do not provide explicit patch/version ...

CVE-2018-15566

CVE-2018-15566 affects tp5cms prior to or on 2017-05-25. The vulnerability is a Cross-Site Scripting (XSS) flaw exploitable via the q parameter in admin.php/article/index.html, enabling injection of arbitrary script/HTML. Affected component is tp5cms’s admin article listing functionality; root ca...

CVE-2018-15568

The CVE-2018-15568 issue affects tp5cms (ThinkPHP-based CMS) through 2017-05-25, with a Cross-Site Request Forgery (CSRF) vulnerability exposed via the admin.php/category/delete.html page. The vulnerability allows CSRF to cause deletion actions (notably “type items”) when an attacker entices an a...

PT-2018-13091

Name of the Vulnerable Software and Affected Versions tp5cms versions prior to 2017-05-25 Description The issue allows for XSS via the q parameter in the "admin.php/article/index.html" API endpoint. Recommendations For versions prior to 2017-05-25, avoid using the q parameter in the...

PT-2018-13093

Name of the Vulnerable Software and Affected Versions tp5cms versions prior to 2017-05-25 Description The issue allows for CSRF via the "admin.php/category/delete.html" endpoint. This can potentially lead to unauthorized actions on the affected system. Recommendations For versions prior to...

PT-2018-13096

Name of the Vulnerable Software and Affected Versions waimai Super Cms version 20150505 Description The issue concerns a stored XSS vulnerability. It can be triggered via the /admin.php/Foodcat/editsave API endpoint, specifically through the fcname parameter. Recommendations For waimai Super Cms...

CVE-2018-15568: Cross-Site Request Forgery (CSRF)

tp5cms through 2017-05-25 has CSRF via admin.php/category/delete.html...

CVE-2018-15566: Improper Neutralization of Input During Web Page Generation

tp5cms through 2017-05-25 has XSS via the admin.php/article/index.html q parameter...

CVE-2018-15570: Improper Neutralization of Input During Web Page Generation

In waimai Super Cms 20150505, there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter...

PT-2018-12901

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1.4 Description The issue allows a remote authenticated attacker to execute arbitrary SQL commands. This is achieved via the id parameter in the interface/forms admin/forms admin.php file, which is affected by the...

CVE-2018-15198

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/User/add.html that can add a user...

CVE-2018-15197

An issue was discovered in OneThink v1.1. There is a CSRF vulnerability in admin.php?s=/AuthManager/addToGroup.html that can endow administrator privileges...

CVE-2018-15197

CVE-2018-15197 affects OneThink v1.1. A CSRF in admin.php?s=/AuthManager/addToGroup.html could grant administrator privileges, enabling privilege escalation. The issue is described across multiple feeds (NVD/Red Hat/CVEs) as allowing an attacker to endow admin rights; no public exploit details or...

CVE-2018-15198

CVE-2018-15198 affects OneThink v1.1. A CSRF in admin.php?s=/User/add.html can add a user. Exploitation context and impact are described (CVSS2/3: base scores 6.8/8.8; network vector, no auth, user interaction required). No remediation/patch details are provided in the connected documents; no add...