1606 matches found
Responsive Menu < 4.0.4 - CSRF to Arbitrary File Upload
"Attackers could craft a request and trick an administrator into uploading a zip archive containing malicious PHP files. The attacker could then access those files to achieve remote code execution and further infect the targeted site." function submitRequest var xhr = new XMLHttpRequest;...
CVE-2020-29250
CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php...
CVE-2020-29250
CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php...
Design/Logic Flaw
CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php...
CVE-2020-29250
CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php...
CVE-2020-29250
CXUUCMS V3 contains a Cross-Site Scripting (XSS) vulnerability that can be triggered via the first and third input fields to /public/admin.php. The issue is documented across multiple connected sources (e.g., Red Hat, CNVD, CVE records) and is described as CXUUCMS V3 allowing XSS through those in...
CVE-2020-35346
CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add...
Cross site scripting
CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add...
Cross site request forgery (csrf)
CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add...
CVE-2020-35347
CXUUCMS V3 3.1 has a CSRF vulnerability that can add an administrator account via admin.php?c=adminuser&a=add...
CVE-2020-35346
CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add...
CVE-2020-35346
CXUUCMS V3.1 is affected by a reflected cross-site scripting (XSS) flaw originating from the imgurl parameter in admin.php?c=content&a=add. The vulnerability allows remote attackers to inject arbitrary web script or HTML, as described across multiple sources (NVD, Red Hat, CNVD, CNVD-derived entr...
Code injection
Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of admin.php?reqGadget=Components&reqAction=InstallGadget&comp=FileBrowser and admin.php?reqGadget=FileBrowser&reqAction=Files to upload a .php file. NOTE: this is unrelated to the JAWS aka Job...
CVE-2020-35656
CVE-2020-35656 affects Jaws (CMS) up to version 1.8.0. The vulnerability arises from crafted requests to admin.php?reqGadget=Components&reqAction=InstallGadget&comp=FileBrowser and admin.php?reqGadget=FileBrowser&reqAction=Files, which allow an authenticated administrator to upload a .php file an...
Sql injection
PHPSHE 1.7 has SQL injection via the admin.php?mod=user&userlevelid=1 userlevelid parameter...
CVE-2020-19165
PHPSHE 1.7 has SQL injection via the admin.php?mod=user&userlevelid=1 userlevelid parameter...
CVE-2020-19165
PHPSHE 1.7 is affected by CVE-2020-19165: an SQL injection in the admin.php?mod=user&userlevel_id=1 and userlevel_id[] parameter. The issue originates from unsafely handling userlevel_id input, enabling an attacker to manipulate SQL queries. No remediation details are provided in the connected do...
CVE-2020-25273
In SourceCodester Online Bus Booking System 1.0, there is Authentication bypass on the Admin Login screen in admin.php via username or password SQL injection...