CVE-2017-9452

CVE-2017-9452 describes a cross-site scripting (XSS) vulnerability in the Piwigo web photo gallery. The issue is in the admin.php handler where the parameter page can be manipulated to inject arbitrary script or HTML. Affected software: Piwigo 2.9.0 and earlier. Impact: remote attackers could exe...

FineCMS Cross-Site Scripting Vulnerability (CNVD-2017-10156)

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. A cross-site scripting vulnerability exists in the sitename parameter in the admin.php script of FineCMS 2017-05-28 and earlier versions. An attacker can exploit this vulnerability to inject...

Cross site scripting

andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the sitename parameter to admin.php...

CVE-2017-9251

andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the sitename parameter to admin.php...

CVE-2017-9251

andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the sitename parameter to admin.php...

CVE-2017-9251

FineCMS prior to 2017-05-28 is vulnerable to a reflected XSS in the sitename parameter of admin.php. The vulnerability is confirmed across multiple sources; the root cause is unsanitized input reflected in the sitename field. Impact is XSS (arbitrary script/HTML execution) in affected pages. Expl...

Piwigo cross-site scripting vulnerability (CNVD-2017-08783 )

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time and more. A cross-site scripting vulnerability exists in the admin.php file in Piwigo 2.9.0 and earlier versions. A remote attacker...

Wordpress Plugin Single Personal Message SQL Injection Vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A SQL injection vulnerability exists in the message parameter of the admin.php page of the Wordpress plugin Sing...

groentenonline.nl XSS vulnerability

Vulnerable URL: http://www.groentenonline.nl/admin.php?error=%22%22/%3E%3Cimg%20src=x%20onerror=prompt/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 02.09.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / No...

CVE-2003-0589

admin.php in Digi-ads 1.1 allows remote attackers to bypass authentication via a cookie with the username set to the name of the administrator, which satisfies an improper condition in admin.php that does not require a correct password...

CVE-2003-0589

CVE-2003-0589 affects Digi-ads 1.1 where admin.php allows remote authentication bypass by sending a cookie with the username set to the administrator’s name. The root cause is an improper condition in admin.php that does not require a correct password, enabling an attacker to gain admin access vi...

Simple Blog PHP 2.0 - SQL Injection

Simple Blog PHP 2.0 - SQL Injection ===================================================== Simple Blog PHP 2.0 - SQL Injection ===================================================== Vendor Homepage: http://simpleblogphp.com/ Date: 13 Oct 2016 Demo Link : http://simpleblogphp.com/blog/admin.php...

Simple Blog PHP 2.0 - SQL Injection

Exploit for php platform in category web applications ===================================================== Simple Blog PHP 2.0 - SQL Injection ===================================================== Vendor Homepage: http://simpleblogphp.com/ Date: 13 Oct 2016 Demo Link :...

Simple Blog PHP 2.0 - SQL Injection

===================================================== Simple Blog PHP 2.0 - SQL Injection ===================================================== Vendor Homepage: http://simpleblogphp.com/ Date: 13 Oct 2016 Demo Link : http://simpleblogphp.com/blog/admin.php Version : 2.0 Platform : WebApp - PHP...

PHP Press Release Cross-Site Request Forgery Vulnerability

PHP Press Release is a software that allows you to manage your organization's press releases via the web, and the public can access recent releases via the web. A cross-site request forgery vulnerability exists in the administration.php page of PHP Press Release, which can be exploited by an...

WordPress Plugin W3 Total Cache 'admin.php' Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language. w3 Total Cache is one of the blog optimization plug-ins. A cross-site scripting vulnerability exists in the WordPress plugin W3 Total Cache 'admin.php' 0.9.4.1 and earlier. An attacker can...

Modoer review system admin.php cross-site script execution vulnerability

Modoer review system a professional review website system, a variety of industry reviews, you can freely regulate the type of review project. Modoer system version 20150505 cross-site scripting vulnerability exists in the background, due to the failure to limit the act parameters when loading...

WordPress WP-DownloadManager Plugin 1.68.1 arbitrary file upload vulnerability

Vulnerability file: download-add.php Vulnerability code: if ! empty $POST'do' checkadminreferer'wp-downloadmanageradd-file'; // Decide What To Do switch $POST'do' // Add File case 'Add File', 'wp-downloadmanager': $filetype = ! empty $POST'filetype' ? intval $POST'filetype' : 0; switch$filetype...

WordPress Levo-Slideshow 2.3 Shell Upload

Document Title: =============== Wordpress Levo-Slideshow 2.3 - Arbitrary File Upload Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1854 Release Date: ============= 2016-06-07 Vulnerability Laboratory ID VL-ID:...

Xoops 2.5.7.2 - Cross-Site Request Forgery (Arbitrary User Deletions)

Exploit for php platform in category web applications var c=-1 var amttodelete=100 var id=document.getElementById"ids" var frm=document.getElementById"CSRF" function doit c++ arguments1.valu...