Subrion CMS Cross-Site Request Forgery Vulnerability (CNVD-2017-04653)

Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A cross-site request forgery vulnerability exists in admin/blocks/add/URI in Subrion CMS version 4.0.5. An...

CVE-2017-6068: Cross-Site Request Forgery (CSRF)

Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter...

CVE-2017-7257

XSS exists in the CMS Made Simple CMSMS 2.1.6 "Content--News--Add Article" feature via the m1content parameter. Someone must login to conduct the attack...

PT-2017-17616 · Cms Made Simple · Cms Made Simple

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions 2.1.6 Description: A security issue exists in the "Content--News--Add Article" feature of the software, where an attacker can exploit the m1 content parameter to conduct a cross-site scripting XSS attack. This attack...

PHP Code Execution Vulnerability in the Content Parameter of Mixcall Seat Management System

Mixcall seat management system is based on B/S architecture, the management personnel can directly log into the Mixcall seat management center through the computer, and view the detailed situation related to the seat personnel's voice services. A PHP code execution vulnerability exists in the...

SQL Injection Vulnerability in the Content Parameter of the /www/index.php Page of Hi-Read Media's Digital Newspaper System

Joy Reading Kiosk Digital Newspaper System is a digital newspaper WEB management system. There is a SQL injection vulnerability in this product, the vulnerability URL is: /www/index.php?mod=admin&con=review&content=1, the vulnerability parameter is: content, the attacker can use the vulnerability...

CVE-2016-6174

applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite aka Invision Power Board, IPB, or Power Board before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the contentclass parameter...

Code injection

applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite aka Invision Power Board, IPB, or Power Board before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the contentclass parameter...

CVE-2016-6174

applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite aka Invision Power Board, IPB, or Power Board before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the contentclass parameter...

PT-2015-7426

Name of the Vulnerable Software and Affected Versions Nibbleblog versions prior to 4.0.5 Description The issue allows remote attackers to hijack the authentication of administrators for requests. This can be achieved through two main actions: 1 creating a post via a new simple action to...

ThinkSAAS 前台SQL注入（通杀所有版本？？？）

简要描述： 这几天一直在审计thinksaas，几个版本都看过，有个地方感觉有注入一直搞不定。 在此感谢 @狗狗侠 @牛肉包子 两位大牛的指点 详细说明： 看最新版的，16天前更新的。 app/group/action/do.php 看下回复评论出的代码 case "recomment": if$POST'token' != $SESSION'token' echo 1;exit; $referid = intval$POST'referid'; $topicid = intval$POST'topicid'; $content = tsClean$POST'content';...

Cross site scripting

Cross-site scripting XSS vulnerability in FlatPress 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the content parameter to the default URI...

CVE-2014-100036

CVE-2014-100036 is an XSS vulnerability affecting FlatPress 1.0.2, where an attacker can inject arbitrary web script or HTML via the content parameter to the default URI. The root cause is a failure to properly sanitize user-supplied content in the default URI handling, enabling reflected or stor...

CVE-2014-100036: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in FlatPress 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the content parameter to the default URI...

CVE-2011-5317: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in editText.php in WonderCMS before 0.4 allows remote attackers to inject arbitrary web script or HTML via the content parameter...

CVE-2014-5519

The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the editcontent parameter to index.php/HeIp. NOTE: some of these details are obtained from third party information...

CVE-2014-5178

Multiple cross-site scripting XSS vulnerabilities in Easy File Sharing EFS Web Server 6.8 allow remote authenticated users to inject arbitrary web script or HTML via the content parameter when 1 creating a topic or 2 posting an answer. NOTE: some of these details are obtained from third party...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Easy File Sharing EFS Web Server 6.8 allow remote authenticated users to inject arbitrary web script or HTML via the content parameter when 1 creating a topic or 2 posting an answer. NOTE: some of these details are obtained from third party...

CVE-2014-5178

CVE-2014-5178 affects Easy File Sharing (EFS) Web Server 6.8. The vulnerability is cross-site scripting (XSS) triggered by the content parameter during topic creation or when posting an answer, exploitable by remote authenticated users. The provided documents do not specify a patch or a remediati...

CVE-2014-5178

Multiple cross-site scripting XSS vulnerabilities in Easy File Sharing EFS Web Server 6.8 allow remote authenticated users to inject arbitrary web script or HTML via the content parameter when 1 creating a topic or 2 posting an answer. NOTE: some of these details are obtained from third party...