Sql injection

Taocms v3.0.2 was discovered to contain an arbitrary file read vulnerability via the path parameter. SQL injection vulnerability via taocms\include\Model\Article.php...

Sql injection

FlameCMS 3.3.5 contains a SQL injection vulnerability in /master/article.php via the "Id" parameter...

Cross site scripting

Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the catid parameter to downloads/downloads.php or article.php. NOTE: this might overlap CVE-2012-6043...

CVE-2020-12708

PHP-Fusion 9.03.50 is affected by multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary script or HTML via the cat_id parameter to downloads/downloads.php or article.php. The issue is a result of insufficient input validation in these endpoints and is...

CVE-2020-10461

The way comments in article.php vulnerable function in include/functions-article.php are handled in Chadha PHPKB Standard Multi-Language 9 allows attackers to execute Stored Blind XSS injecting arbitrary web script or HTML in admin/manage-comments.php, via the GET parameter cmt...

CVE-2020-10445

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-article.php by adding a question mark ? followed by the payload...

CVE-2020-10391

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/add-article.php by adding a question mark ? followed by the payload...

CVE-2020-10401

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/edit-article.php by adding a question mark ? followed by the payload...

Cross site scripting

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-article.php by adding a question mark ? followed by the payload...

CVE-2020-10496

Chadha PHPKB Standard Multi-Language 9 is vulnerable to a Cross-Site Request Forgery (CSRF) in the admin/edit-article.php endpoint. The vulnerability allows an attacker to cause article edits by crafting a request that an authenticated user would submit, due to insufficient validation/CSRF protec...

CVE-2020-10464

CVE-2020-10464 concerns Chadha PHPKB Standard Multi-Language 9, with a reflected XSS in admin/edit-article.php via the GET parameter p. The vulnerability allows an attacker to inject arbitrary web script or HTML when a user visits a crafted URL, affecting the affected PHPKB component and involvin...

CVE-2020-10452

CVE-2020-10452 concerns Chadha PHPKB Standard Multi-Language 9. Reflected XSS via URIs processed in admin/header.php, enabling injection of script/HTML when an attacker crafts a URI that is passed to admin/add-article.php/save-article.php (and related admin pages as per connected Red Hat advisori...

CVE-2020-10401

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/edit-article.php by adding a question mark ? followed by the payload...

CVE-2020-10391

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/add-article.php by adding a question mark ? followed by the payload...

PT-2020-12058 · Chadha · Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue concerns the handling of the Referer header in article.php, allowing attackers to execute Stored Blind XSS by injecting arbitrary web script or HTML. This is specifically...

CVE-2018-20561

CVE-2018-20561 affects DouCo DouPHP 1.5 20181221. The vulnerability is a stored/reflected XSS in admin/article.php?rec=update via the title parameter, enabling injection of arbitrary script/HTML as described in multiple sources. Affected component is the admin interface (article update logic) and...

Arbitrary File Deletion Vulnerability in ECShop

ECShop is a B2C independent online store system, suitable for enterprises and individuals to quickly build a personalized online store. The system is based on PHP language and MYSQL database structure development of cross-platform open source program. ECShop V3.0.0 UTF8 release0530 version of the...

SQL Injection Vulnerability in ThinkLC Classifieds Information System article.php Page

ThinkLC Classified Information System is a local classified information system built on PHP+MYSQL development. A SQL injection vulnerability exists in the article.php page of ThinkLC Classified Information System. The vulnerability is caused due to the system failing to effectively filter...

tapaa.or.th XSS vulnerability

Vulnerable URL: http://tapaa.or.th/infor-article.php?id=5%22%3E%3Cscript%3Ealert0;%3C%2Fscript%3E〈=en Details: Description| Value ---|--- Patched:| No Latest check for patch:| 18.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP...

quinnco.com XSS vulnerability

Vulnerable URL: http://www.quinnco.com/article.php?id=2'"--!confirmOPENBUGBOUNTY...