ZZCMS has a reinstallation vulnerability

ZZCMS is a free website builder developed in asp language. ZZCMS has a reinstallation vulnerability. An attacker can exploit the vulnerability to reset the administrator username password and so on...

Joomla! cross-site request forgery vulnerability (CNVD-2020-21000)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A cross-site request forgery vulnerability exists in Joomla! versions 3.2.0 through 3.9.15. The vulnerability stems from a WEB application that does...

NETGEAR Nighthawk X10-R9000 Cross-Site Scripting Vulnerability

The NETGEAR Nighthawk X10-R9000 is a wireless router from NETGEAR. A cross-site scripting vulnerability exists in the NETGEAR Nighthawk X10-R9000 using firmware prior to version 1.0.4.24. The vulnerability stems from a lack of proper validation of client data by the WEB application. An attacker c...

SMC Networks SMC D3G0804W Cross-Site Scripting Vulnerability

The SMC Networks SMC D3G0804W is a wireless router from SMC Networks USA. A cross-site scripting vulnerability exists in SMC Networks SMC D3G0804W version 3.5.2.5-LATGA. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can exploit the...

Netis DL4323 Cross-Site Request Forgery Vulnerability

NETCORE Netis DL4323 is a multi-function modem from China's NETCORE. A cross-site request forgery vulnerability exists in the NETCORE Netis DL4323. The vulnerability arises from a WEB application that does not adequately verify that a request is from a trusted user. An attacker could exploit this...

D-Link DIR-601 Cross-Site Request Forgery Vulnerability

The D-Link DIR-601 B1 is a wireless router from AUO D-Link of Taiwan, China. A cross-site request forgery vulnerability exists in the D-Link DIR-601 B1 version 2.00NA. The vulnerability stems from a WEB application that does not adequately verify that a request is from a trusted user. An attacker...

Pivotal Software RabbitMQ Cross-Site Scripting Vulnerability

Pivotal Software RabbitMQ is the United States Pivotal Software, Inc. of a set of implementation of the Advanced Message Queuing Protocol AMQP open source message broker software. A cross-site scripting vulnerability exists in Pivotal Software RabbitMQ. The vulnerability stems from a lack of prop...

Serendipity Package Cross-Site Scripting Vulnerability

Serendipity is a PHP-based blogging system from the Serendipity team. The system supports the creation of online journals, blogs, web pages and more. A cross-site scripting vulnerability exists in Xinha in Serendipity packages prior to version 1.5.5. The vulnerability stems from a lack of proper...

TP-Link TL-WDR4300 Cross-Site Request Forgery Vulnerability (CNVD-2019-40473)

The TP-Link TL-WDR4300 is a wireless router from China P&L TP-Link. A cross-site request forgery vulnerability exists in the TP-Link TL-WDR4300 version 3.13.31. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user, and can b...

Thycotic Secret Server Cross-Site Scripting Vulnerability (CNVD-2019-38073)

Thycotic Secret Server is a privileged account management solution from Thycotic USA. A cross-site scripting vulnerability exists in Thycotic Secret Server versions prior to 10.7. The vulnerability stems from the lack of proper validation of client-side data by the WEB application, and can be...

cPanel cross-site scripting vulnerability (CNVD-2019-28987)

cPanel is a set of Web-based automated colocation platforms from the American company cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in the listftpstable AP in versions prior to cPanel 60.0.25. The vulnerabili...

cPanel cross-site scripting vulnerability (CNVD-2019-26352)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A cross-site scripting vulnerability exists in versions prior to cPanel 70.0.23. The vulnerability stems from a lack of proper...

Eventum Cross-Site Scripting Vulnerability (CNVD-2019-39387)

Eventum is a defect tracking system. The system is used to track inbound technical support, organizational tasks, bugs, etc. A cross-site scripting vulnerability exists in the /htdocs/popup.php file in Eventum version 3.5.0. The vulnerability stems from a lack of proper validation of client-side...

CVE-2019-9106

The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to execute or include local .php files, as demonstrated by menu=php://filter/convert.base64-encode/resource=index.php to read index.php...

CloudBees Jenkins Kmap Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software release/testing projects and some timed tasks . Kmap Plugin is used in one of the application release...

CVE-2018-14068

An issue was discovered in SRCMS V2.3.1. There is a CSRF vulnerability that can add an admin account via admin.php?m=Admin&c=manager&a=add...

CVE-2018-7650

PHP Scripts Mall Hot Scripts Clone:Script Classified Version 3.1 Application is vulnerable to stored XSS within the "Add New" function for a Management User. Within the "Add New" section, the application does not sanitize user supplied input to the name parameter, and renders injected JavaScript...

Design/Logic Flaw

A uncontrolled search path element issue was discovered in Vyaire Medical CareFusion Upgrade Utility used with Windows XP systems, Versions 2.0.2.2 and prior versions. A successful exploit of this vulnerability requires the local user to install a crafted DLL on the target machine. The applicatio...

CVE-2017-17693

Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remove feedback...

SQL injection vulnerability in UQCMS cloud merchant B2B2C multi-store system plug.class.php page

B2B2C multi-store system is a B2B2C e-commerce software with PHP+MYSQL program and smarty template. A SQL injection vulnerability exists in the plug.class.php page of the UQCMS Cloud Business B2B2C Multi-Store System. The vulnerability stems from the fact that the program does not adequately filt...