295 matches found
WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2018-14089)
WUZHI CMS is China's five fingers WUZHI Internet technology company based on PHP and MySQL open source content management system CMS. A cross-site scripting vulnerability exists in WUZHI CMS version 4.1.0. A remote attacker can inject arbitrary Web script or HTML by sending the 'formcontent'...
GreenCMS Cross-Site Request Forgery Vulnerability (CNVD-2018-13895)
GreenCMS is a content management system CMS based on ThinkPHP. A cross-site request forgery vulnerability exists in GreenCMS version 2.3.0603. A remote attacker can exploit this vulnerability by sending the 'content' parameter to the index.php?m=admin&c=media&a=fileconnect URL to execute arbitrar...
Ximdex cross-site scripting vulnerability (CNVD-2018-14423)
Ximdex is a content and data management system. The system includes features such as an intelligent search engine, information aggregation, image and text recognition. A cross-site scripting vulnerability exists in the xowl/request.php file in Ximdex version 4.0. A remote attacker can exploit thi...
CVE-2018-12272: Improper Neutralization of Input During Web Page Generation
xowl/request.php in Ximdex 4.0 has XSS via the content parameter...
CVE-2018-11670: Cross-Site Request Forgery (CSRF)
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary PHP code via the content parameter to index.php?m=admin&c=media&a=fileconnect...
CVE-2018-8805
Yxcms building system compatible cell phone v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extendguestbook.php or protected\apps\default\view\mobile\extendguestbook.php in an index.php?r=default/column/index&col=guestbook request...
CVE-2018-8805
Yxcms building system compatible cell phone v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extendguestbook.php or protected\apps\default\view\mobile\extendguestbook.php in an index.php?r=default/column/index&col=guestbook request...
CVE-2018-8805: Improper Neutralization of Input During Web Page Generation
Yxcms building system compatible cell phone v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extendguestbook.php or protected\apps\default\view\mobile\extendguestbook.php in an index.php?r=default/column/index&col=guestbook request...
CVE-2017-17407
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager v7.2.699 build 1001. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the content parameter provided ...
CVE-2017-17407: Improper Neutralization of Special Elements used in an OS Command
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager v7.2.699 build 1001. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the content parameter provided ...
NetGain Enterprise Manager Command Execution Vulnerability
Netgain Enterprise Manager is a suite of IT asset monitoring and management software from NetGain Systems, Singapore. A command execution vulnerability exists in the handling of the 'content' parameter in NetGain Enterprise Manager. A remote attacker could exploit this vulnerability to execute...
CVE-2017-16903: Improper Limitation of a Pathname to a Restricted Directory
LvyeCMS through 3.1 allows remote attackers to upload and execute arbitrary PHP code via directory traversal sequences in the dir parameter, in conjunction with PHP code in the content parameter, within a template Style add request to index.php...
CVE-2017-15987
Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content.php id parameter...
SQL Injection Vulnerability in DBShop search_content Parameter
DBShop based on PHP official ZendFramework 2 framework for the development of a new generation of e-commerce system perfect support for PHP7. A SQL injection vulnerability exists in the DBShop searchcontent parameter, due to the program failing to filter user input data. An attacker can exploit...
SQL Injection Vulnerability in List_content Parameter of SMiCMS Government Website System
State Micro CMS for one of the country's most mainstream CMS systems, but also in southern China in the field of PHP open source platform provider. State Micro CMS government website system listcontent parameter SQL injection vulnerability , the vulnerability is due to the failure of the user to...
SQL Injection Vulnerability in the Content Parameter of smsreportxiang.jsp File on ECS Customer Management Platform
Enterprise letter is the use of java development of a special tailored to the enterprise customer value-added SMS business, enterprise customers in the use of computers at the same time can be completed with the production of office combined with the internal SMS communication. SQL injection...
Fiyo CMS Arbitrary File Upload Vulnerability
Fiyo CMS is a content management system CMS for creating CMS templates. A security vulnerability exists in Fiyo CMS versions 2.x through 2.0.7. The vulnerability can be exploited by an attacker to execute code by sending the 'content' parameter to the file /dapur/apps/apptheme/libs/savefile.php...
CVE-2017-7625
In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/apptheme/libs/savefile.php" and then execute code...
