154 matches found
CVE-2018-16314
An issue was discovered in admincp.php in idreamsoft iCMS 7.0.11. When verifying CSRFTOKEN, if CSRFTOKEN does not exist, only the Referer header is validated, which can be bypassed via an admincp.php substring in this header...
iCMS SQL Injection Vulnerability (CNVD-2018-14361)
iCMS is a content management system CMS built with PHP and MySQL databases. A SQL injection vulnerability exists in the spider.admincp.php file in iCMS version 7.0.8. A remote attacker can exploit this vulnerability by sending an app=spider&do=batch request with the 'id' parameter to the...
Cross site request forgery (csrf)
An issue was discovered in AKCMS 6.1. CSRF can delete an article via an admincp deleteitem action to index.php...
CVE-2018-12583
An issue was discovered in AKCMS 6.1. CSRF can delete an article via an admincp deleteitem action to index.php...
CVE-2018-12583
AKCMS 6.1 is affected by a cross-site request forgery (CSRF) that can delete articles via the admincp deleteitem action to index.php. The vulnerability is described in CVE-2018-12583 and corroborated by CNVD-2018-14261 and related records, which state an attacker could exploit CSRF to delete arti...
CVE-2018-10250
iCMS V7.0.8 has XSS via the admincp.php keywords parameter in a weixincategory action, aka a WeChat Classified Management keyword search...
CVE-2018-10222
An issue was discovered in idreamsoft iCMS V7.0. There is a CSRF vulnerability that can add a Column via /admincp.php?app=articlecategory&do=save&frame=iPHP...
CVE-2018-9925
An issue was discovered in idreamsoft iCMS through 7.0.7. XSS exists via the nickname field in an admincp.php?app=user&do=save&frame=iPHP request...
SQL Injection Vulnerability in iCMS v7.0.7 admincp.app.php Page
iCMS is a free, clean, efficient, and useful PHP content management system. iCMS v7.0.7 suffers from a SQL injection vulnerability in the admincp.app.php page. The vulnerability stems from the orderby parameter being brought into the database for execution without any processing. An attacker can...
SQL Injection Vulnerability in iCMS v7.0.7 keywords.admincp.php Page
iCMS is a free, clean, efficient, and useful PHP content management system. A SQL injection vulnerability exists in the iCMS v7.0.7 keywords.admincp.php page. The vulnerability stems from the orderby parameter being brought into the database for execution without any processing. An attacker can...
SQL Injection Vulnerability in iCMS v7.0.7 apps.admincp.php Page
iCMS is a free, clean, efficient, and useful PHP content management system. iCMS v7.0.7 has a SQL injection vulnerability in the apps.admincp.php page. The vulnerability stems from the orderby parameter being brought into the database for execution without any processing. An attacker can exploit...
MyBB 1.8.12 Stored XSS / File Enumeration
| \ | \ | | | | | | / \ | | | |/ / | |/ / | | | | | | | | | / / | | | / | / | | | | | | | | | | | | | | | |\ \ \ / / // / | | | /\ | | | | | / / / / / | | | \ | | / | | | / \ | | | | | \ | | | | \ \ / / | | | | | \ --. | | | / / | | | | | |/ / | | | | \ V / | | | . | --. \ | | | | | |...
Discuz! admincp.php CSRF引起XSS
首先是一个CSRF：url：/admincp.php?action=members&operation=newsletter&username=%2A&uid=0&srchemail=®datebefore=®dateafter=&postshigher=&postslower=®ip=&lastip=&lastvisitafter=&lastvisitbefore=&lastpostafter=&lastpostbefore=&birthyear=&birthmonth=&birthday=&lowercredits=&lowerextcredits1=&lowere...
MvMmallv5. 5SQL injection of php exp exploit-vulnerability warning-the black bar safety net
Vulnerability type: MvMmall v5. 5. 1 SQL injection vulnerability Default background:admincp. php? module=index Google search:”Powered by MvMmall v5. 5. 1" One, use: php exp use 1 Install the php environment Use phpnow very simple to install. 2 Use exp attack Link: Extract password: aahj The exp...
Sql injection
Multiple SQL injection vulnerabilities in TopicsViewer 3.0 Beta 1 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 editblock.php, 2 editcat.php, 3 editnote.php, or 4 rmvtopic.php in admincp/...
CVE-2014-10023: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in TopicsViewer 3.0 Beta 1 allow remote attackers to execute arbitrary SQL commands via the id parameter to 1 editblock.php, 2 editcat.php, 3 editnote.php, or 4 rmvtopic.php in admincp/...
CVE-2014-8469
Cross-site scripting XSS vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attackers to inject arbitrary web script or HTML via the User-Agent header...
Cross site scripting
Cross-site scripting XSS vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attackers to inject arbitrary web script or HTML via the User-Agent header...
CVE-2014-8469
CVE-2014-8469 is a stored XSS in PHPFox (Moxi9) before 4 Beta, exploitable via the User-Agent header in AdminCP’s Guests/Boots. The issue arises from manipulating the user_agent field, enabling remote script/html injection. Public records show an exploit exists (PHPFox XSS AdminCP) and the vendor...