CVE-2019-10692: Improper Neutralization of Special Elements used in an SQL Command

In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement...

CVE-2019-8902

An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI...

CVE-2019-8902: Cross-Site Request Forgery (CSRF)

An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI...

CVE-2018-20006

CVE-2018-20006 affects PHPok v5.0.055. A Stored XSS flaw exists in the title parameter passed to api.php?c=post&f=save, reachable via index.php?id=book. The underlying issue is unencoded user input being stored and subsequently rendered, enabling script execution in a victim’s browser. Public ref...

PT-2018-15232

Name of the Vulnerable Software and Affected Versions PHPok version 5.0.055 Description A Stored XSS issue was found, which can be exploited via the title parameter to the "api.php?c=post&f=save" API endpoint, accessible through the "index.php?id=book" URI. Recommendations For PHPok version...

CVE-2018-20006: Improper Neutralization of Input During Web Page Generation

An issue was discovered in PHPok v5.0.055. There is a Stored XSS vulnerability via the title parameter to api.php?c=post&f=save reachable via the index.php?id=book URI...

CVE-2018-18319

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed on...

CVE-2018-18319

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed on...

CVE-2018-18319: Improper Control of Generation of Code

An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because api.php has an eval call, as demonstrated by the /6/api.php?function=command&class=remote&Cc='ls' URI. NOTE: the vendor indicates that Merlin.PHP is designed on...

Sql injection

PbootCMS 1.2.1 has SQL injection via the HTTP POST data to the api.php/cms/addform?fcode=1 URI...

CVE-2018-18211

PbootCMS 1.2.1 has SQL injection via the HTTP POST data to the api.php/cms/addform?fcode=1 URI...

CVE-2018-18211

PbootCMS 1.2.1 has SQL injection via the HTTP POST data to the api.php/cms/addform?fcode=1 URI...

CVE-2018-18211

PbootCMS 1.2.1 is affected by an SQL injection vulnerability. The issue occurs via HTTP POST data to the api.php/cms/addform?fcode=1 URI, enabling crafted input to influence SQL queries. This CVE is supported by multiple sources (NVD entry CVE-2018-18211 and related records) indicating a high-sev...

CVE-2018-18211: Improper Neutralization of Special Elements used in an SQL Command

PbootCMS 1.2.1 has SQL injection via the HTTP POST data to the api.php/cms/addform?fcode=1 URI...

CVE-2018-17049

CQU-LANKERS through 2017-11-02 has XSS via the public/api.php callback parameter in an uploadpic action...

CVE-2018-17049: Improper Neutralization of Input During Web Page Generation

CQU-LANKERS through 2017-11-02 has XSS via the public/api.php callback parameter in an uploadpic action...

Sql injection

phpkaiyuancms PhpOpenSourceCMS POSCMS V3.2.0 allows an unauthenticated user to execute arbitrary SQL commands via the diy/module/member/controllers/Api.php ajaxsavedraft function with the dir parameter...

CVE-2018-14940

PHPCMS 9 allows remote attackers to cause a denial of service resource consumption via large fontsize, height, and width parameters in an api.php?op=checkcode request...

CVE-2018-14940

PHPCMS 9 allows remote attackers to cause a denial of service resource consumption via large fontsize, height, and width parameters in an api.php?op=checkcode request...

CVE-2018-14940

PHPCMS 9 is affected by CVE-2018-14940 where remote attackers can trigger a denial of service by sending oversized font_size, height, and width values to api.php?op=checkcode. The connected sources reiterate the same description and CVSS data (NVD), with no concrete remediation details provided i...