Cross site scripting

waimai Super Cms 20150505 contains a cross-site scripting XSS vulnerability in the component /admin.php?&m=Public&a=login...

Cross site scripting

waimai Super Cms 20150505 contains a cross-site scripting XSS vulnerability in the component /admin.php/Link/addsave...

CVE-2020-21506

The CVE-2020-21506 entry concerns waimai Super Cms version 20150505 with a cross-site scripting (XSS) vulnerability in the /admin.php?m=Config&a=add component. The root cause described in connected records is improper input handling that allows injected script to run in a victim’s browser. Impact...

CVE-2020-21504

The CVE-2020-21504 entry documents a cross-site scripting (XSS) vulnerability in waimai Super Cms 20150505, originating from the login component at /admin.php?&m=Public&a=login. Exploitation details are not provided in the documents, but multiple sources describe input handling flaws that enable ...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges...

CVE-2020-21386

CVE-2020-21386 is a CSRF vulnerability in Maccms 10 affecting the component admin.php/admin/type/info.html. The issue arises from its admin flow failing to verify that requests originate from trusted users, enabling an attacker to gain administrator privileges. The connected documents consistentl...

CVE-2021-34650

The eID Easy WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the /admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.6...

Cross site scripting

The eID Easy WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the /admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.6...

CVE-2021-34650

The CVE-2021-34650 entry corresponds to a Reflected Cross-Site Scripting vulnerability in the WordPress plugin eID Easy (versions up to 4.6). The issue arises from the error parameter in admin.php, enabling arbitrary script injection. Public sources consistently identify this as a vulnerability i...

CVE-2021-34650 eID Easy <= 4.6 Reflected Cross-Site Scripting

The eID Easy WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the /admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.6...

eID Easy < 4.7 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the error parameter found in the /admin.php file which allows attackers to inject arbitrary web scripts...

CF Geo Plugin < 7.13.12 - Reflected Cross-Site Scripting

The plugin does not escape the some parameter before outputting them back in admin pages, leading to a Reflected Cross-Site Scripting issue POST /wp-admin/admin.php?page=cf-geoplugin-activate HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language...

Sql injection

SQL Injection vulnerability in cxuucms 3.1 ivia the pid parameter in public/admin.php...

CVE-2021-3264

SQL Injection vulnerability in cxuucms 3.1 ivia the pid parameter in public/admin.php...

Electron Technologies FZC PopojiCMS Cross-Site Request Forgery Vulnerability

Electron Technologies FZC PopojiCMS is an open source content management system CMS based on the Popoji framework from Electron Technologies FZC. version 2.0.1 of Electron Technologies FZC PopojiCMS admin.php is vulnerable to cross-site request forgery. No detailed vulnerability details are...

CVE-2020-19821

A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders parameter...

CVE-2020-19821

A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders parameter...

Sql injection

A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders parameter...

CVE-2020-19821

A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders parameter...

CVE-2020-19821

DOYO CMS (DOYOCMS) 2.3 contains a SQL injection in admin.php reachable via the orders[] parameter, allowing attackers to execute arbitrary SQL commands. Root cause: improper handling/sanitization of the orders[] input leads to injection. Affected component: DOYOCMS 2.3; entry describes high-sever...