EUVD-2018-10938

Malware in sbrugna...

CVE-2018-19229

An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/art.php?typeid=1 biaoti parameter...

CVE-2018-19229

An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/art.php?typeid=1 biaoti parameter...

CVE-2018-19229

LAOBANCMS 2.0 is affected by an XSS vulnerability in the admin/art.php?typeid=1 biaoti parameter. Multiple connected sources (NVD/NVD-derived CVE, Red Hat, CNVD, CVE listings) corroborate that the issue arises from unsanitized input in the biaoti parameter leading to cross-site scripting. The exa...

PT-2018-14882

Name of the Vulnerable Software and Affected Versions LAOBANCMS version 2.0 Description An issue was discovered that allows XSS via the "admin/art.php?typeid=1" endpoint, specifically through the biaoti parameter. Recommendations For LAOBANCMS version 2.0, as a temporary workaround, consider...

CVE-2018-19229: Improper Neutralization of Input During Web Page Generation

An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/art.php?typeid=1 biaoti parameter...

PT-2018-17094

Name of the Vulnerable Software and Affected Versions: Icy Phoenix version 2.2.0.105 Description: The issue allows SQL injection via an unapprove request to "admin kb art.php" or the order parameter to "admin jr admin.php", related to "functions kb.php". Recommendations: For Icy Phoenix version...

aacz.czestochowa.pl XSS vulnerability

Vulnerable URL: http://www.aacz.czestochowa.pl/art.php?id=1477330253,1477330290="';-- Details: Description| Value ---|--- Patched:| No Latest check for patch:| 08.12.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| N...

Cross-site scripting vulnerability in Axublog art.php

Axublog is a PHP personal blog system. A cross-site scripting vulnerability exists in Axublog art.php due to the system failing to filter incoming parameters. An attacker can exploit this vulnerability to plant cross-site code and obtain sensitive information such as administrator cookies...

苹果CMS继续绕过现有全局安全防护措施进行SQL注入，第三发

简要描述： 下一次该告一段落，打包了，主要是希望开发意识到为什么你们的be和360safe3.php没有起到作用 详细说明： 不再具体分析，看第一和第二发， 看下触发页面，inc/module/art.php 第90行： elseif$method=='search' $tpl-P"siteaid" = 25; $wd = be"all", "wd"; if!empty$wd $tpl-P"wd" = $wd; if isN$tpl-P"wd" && isN$tpl-P"ids" && isN$tpl-P"pinyin" && isN$tpl-P"letter" &&...

CVE-2006-2821: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in DeltaScripts Pro Publish allow remote attackers to inject arbitrary web script or HTML via the 1 artid parameter in art.php and the 2 catname parameter in cat.php...

CVE-2006-2128: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Pro Publish 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 email and 2 password parameter to a admin/login.php, 3 findstr parameter to b search.php, or 4 artid parameter to c art.php, or 5 catid parameter to d cat.php...