205 matches found
CVE-2020-10390: Improper Neutralization of Special Elements used in an OS Command
OS Command Injection in export.php vulnerable function called from include/functions-article.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by saving the code to be executed as the wkhtmltopdf path via admin/save-settings.php...
CVE-2020-10461: Improper Neutralization of Input During Web Page Generation
The way comments in article.php vulnerable function in include/functions-article.php are handled in Chadha PHPKB Standard Multi-Language 9 allows attackers to execute Stored Blind XSS injecting arbitrary web script or HTML in admin/manage-comments.php, via the GET parameter cmt...
CVE-2020-10445: Improper Neutralization of Input During Web Page Generation
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-article.php by adding a question mark ? followed by the payload...
CVE-2020-10464: Improper Neutralization of Input During Web Page Generation
Reflected XSS in admin/edit-article.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p...
CVE-2020-10401: Improper Neutralization of Input During Web Page Generation
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/edit-article.php by adding a question mark ? followed by the payload...
CVE-2018-20561
CVE-2018-20561 affects DouCo DouPHP 1.5 20181221. The vulnerability is a stored/reflected XSS in admin/article.php?rec=update via the title parameter, enabling injection of arbitrary script/HTML as described in multiple sources. Affected component is the admin interface (article update logic) and...
CVE-2018-20561: Improper Neutralization of Input During Web Page Generation
An issue was discovered in DouCo DouPHP 1.5 20181221. admin/article.php?rec=update has XSS via the title parameter...
PT-2018-15431
Name of the Vulnerable Software and Affected Versions DouPHP version 1.5 20181221 Description An issue was discovered in DouCo DouPHP. The "admin/article.php?rec=update" API endpoint has a cross-site scripting XSS issue via the title parameter. Recommendations For DouPHP version 1.5 20181221, avo...
Arbitrary File Deletion Vulnerability in ECShop
ECShop is a B2C independent online store system, suitable for enterprises and individuals to quickly build a personalized online store. The system is based on PHP language and MYSQL database structure development of cross-platform open source program. ECShop V3.0.0 UTF8 release0530 version of the...
CVE-2018-6029: Server-Side Request Forgery (SSRF)
The copy function in application/admin/controller/Article.php in NoneCms 1.3.0 allows remote attackers to access the content of internal and external network resources via Server Side Request Forgery SSRF, because URL validation only considers whether the URL contains the "csdn" substring...
SQL Injection Vulnerability in ThinkLC Classifieds Information System article.php Page
ThinkLC Classified Information System is a local classified information system built on PHP+MYSQL development. A SQL injection vulnerability exists in the article.php page of ThinkLC Classified Information System. The vulnerability is caused due to the system failing to effectively filter...
tapaa.or.th XSS vulnerability
Vulnerable URL: http://tapaa.or.th/infor-article.php?id=5%22%3E%3Cscript%3Ealert0;%3C%2Fscript%3E〈=en Details: Description| Value ---|--- Patched:| No Latest check for patch:| 18.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP...
quinnco.com XSS vulnerability
Vulnerable URL: http://www.quinnco.com/article.php?id=2'"--!confirmOPENBUGBOUNTY...
iDesign CMS v2.7 - SQL Injection Web Vulnerability
Document Title: =============== iDesign CMS v2.7 - SQL Injection Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1865 Release Date: ============= 2016-06-29 Vulnerability Laboratory ID VL-ID: ==================================== 1865...
DouPHP admin/article.php image parameter SQL injection
No description provided by source...
WDS CMS /wds_news/article.php SQL注入
Exploit : http:// Target/wdsnews/article.php?ID=-1+union+select+1,groupconcatusername,0x3a,password,3,4,5,6,7,8,9,10+from+cmsadmin-- Upload Shell : http://Target/wdsnews/admin.php?mode=listfile Shell Path : http://Target/wdsnews/filer/shell.php...
ACGV News <= 0.9.1 (PathNews) Remote File Inclusion Vulnerability
No description provided by source. ============================================================================================== ACGV News = v0.9.1 PathNews Remote File Inclusion Exploit =============================================================================================== Critical Leve...
N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability
No description provided by source. N/X - Web CMS N/X WCMS 4.5 Multiple Vulnerability =================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ /'...
XOOPS 2.0.14 (article.php) SQL Injection Vulnerability
No description provided by source. / \ / | | | \ / | | | | | | | | | | || | | | | | | | | '| | | | | | | | | | |/ \ / |/ / / | | | | || | || | || || | / || | | | / | | || / / |/ || ,|\|,| +-+-+-+-+ |C|r|e|w| +-+-+-+-+ XOOPS 2.0.14 article.php SQL Injection Vulnerability Discovered By 0iZy5...