Remote code execution

ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution...

CVE-2020-17551

ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution...

CVE-2020-21564

CVE-2020-21564 concerns Pluck CMS versions 4.7.10-dev2 and 4.7.11, where a file upload vulnerability can lead to remote command execution via the endpoint admin.php?action=files. The sources provided describe the vulnerability but do not specify additional technical details, exploit status, affec...

Cross site scripting

Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting XSS via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and executed...

CVE-2020-10984

Gambio GX before 4.0.1.0 allows admin/admin.php CSRF...

CVE-2020-10984

Gambio GX (before 4.0.1.0) contains a CSRF vulnerability in admin/admin.php. The CVE entry CVE-2020-10984 documents a cross-site request forgery flaw affecting the admin interface; no explicit remediation is provided in the connected sources. The public references confirm the affected product/ver...

CVE-2020-10984

Gambio GX before 4.0.1.0 allows admin/admin.php CSRF...

CVE-2019-19110

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter...

CVE-2014-8943

Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svnurl parameter...

CVE-2014-8944

Lexiglot through 2014-11-20 allows XSS Reflected via the username, or XSS Stored via the admin.php?page=config installname, intromessage, or newfilecontent parameter...

Sql injection

Lexiglot through 2014-11-20 allows SQL injection via an admin.php?page=users&fromid= or admin.php?page=history&limit= URI...

Cross site scripting

Lexiglot through 2014-11-20 allows XSS Reflected via the username, or XSS Stored via the admin.php?page=config installname, intromessage, or newfilecontent parameter...

Server side request forgery (ssrf)

Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svnurl parameter...

CVE-2014-8941

CVE-2014-8941 affects Lexiglot (PHP translation platform) through 2014-11-20. The issue is a SQL injection vulnerability arising from unsafely built queries in the admin interface, specifically via URLs like admin.php?page=users&from_id= and admin.php?page=history&limit=. Evidence across multiple...

CVE-2014-8943

CVE-2014-8943 affects Lexiglot up to 2014-11-20 and enables a server-side request forgery (SSRF) via the admin.php?page=projects svn_url parameter. The available documents identify the vulnerable component as Lexiglot (PHP-based translation platform) and point to the svn_url parameter as the inje...

CVE-2014-8943

Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svnurl parameter...

CVE-2014-8945

CVE-2014-8945 affects Lexiglot, a PHP-based translation platform. The vulnerability is a command injection in admin.php?page=projects, exploitable through the username and password fields. Multiple sources confirm the issue, noting it affects Lexiglot releases up to and including 2014-11-20. The ...

Fishing Reservation System 7.5 - (uid) SQL Injection Vulnerability

Exploit for php platform in category web applications Title: Fishing Reservation System 7.5 - 'uid' SQL Injection Vendor: https://fishingreservationsystem.com/index.html Software: https://fishingreservationsystem.com/features.htm CVE: N/A Technical Details & Description:...

Easy2Pilot 7 - Cross-Site Request Forgery (Add User) Vulnerability

Exploit for php platform in category web applications Exploit Title: Easy2Pilot 7 - Cross-Site Request Forgery Add User Author: indoushka Tested on: windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit Vendor: http://easy2pilot-v7.com/ CVE: N/A poc : + Dorking İn Google Or Other Searc...

WordPress Contact-Form-7 5.1.6 Cross Site Scripting

Title : word press plugin contact-form-7 5.1.6 - Cross-Site Scripting - Author : mehran feizi - Vendor : https://wordpress.org/plugins/contact-form-7/ - Tested on : Windows - Category : Webapps - Date : 2020-02-17...