311 matches found
CVE-2016-6335: Exposure of Sensitive Information to an Unauthorized Actor
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote attackers to obtain sensitive information via a parse action to api.php...
CVE-2016-6331: Improper Access Control
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php...
gaivota.org XSS vulnerability
Vulnerable URL: http://gaivota.org/api.php?callback=prompt/OPENBUGBOUNTY/...
PT-2017-8961
Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.23.0 through 1.23.14 MediaWiki versions 1.26.0 through 1.26.3 MediaWiki versions 1.27.0 through 1.27.0 Description The issue allows remote attackers to bypass intended per-title read restrictions. This is achieved via a...
PT-2017-8965
Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.23.15 MediaWiki versions 1.26.x prior to 1.26.4 MediaWiki versions 1.27.x prior to 1.27.1 Description The issue allows remote attackers to obtain sensitive information via a parse action to "api.php". This is due ...
imo云办公室系统 /api/Api.php 参数cid SQL注入漏洞
No description provided by source...
TaoCMS v2.5Beta4 api.php 存在任意代码执行漏洞
No description provided by source...
h5ai < 0.25.0 /server/php/inc/Api.php 任意文件上传漏洞
No description provided by source...
PHPCMS V9 /api.php Authkey 信息泄漏
No description provided by source...
CVE-2015-2941
Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error...
Cross site scripting
Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error...
UBUNTU-CVE-2015-2941
Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error...
CVE-2015-2941
Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error...
CVE-2015-2941
CVE-2015-2941 affects MediaWiki prior to 1.19.24, 1.2x prior to 1.23.9, and 1.24.x prior to 1.24.2 when HHVM is used. The vulnerability arises from improper handling of a wddx_serialize_value call in api.php for invalid parameters in a wddx format request, which can lead to cross-site scripting v...
CVE-2015-2941
Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error...
CVE-2015-2941
Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error...
PT-2015-5991
Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.19.24 MediaWiki versions 1.20.x through 1.23.9 MediaWiki versions 1.24.x through 1.24.2 Description A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via an...
CVE-2015-2941: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error...
CVE-2014-8790
XML external entity XXE vulnerability in admin/api.php in GetSimple CMS 3.1.1 through 3.3.x before 3.3.5 Beta 1, when in certain configurations, allows remote attackers to read arbitrary files via the data parameter...
PT-2015-4081
Name of the Vulnerable Software and Affected Versions GetSimple CMS versions 3.1.1 through 3.3.x Description The issue allows remote attackers to read arbitrary files via the data parameter in certain configurations. This is due to an XML external entity XXE vulnerability in the admin/api.php fil...