291 matches found
CVE-2018-12272: Improper Neutralization of Input During Web Page Generation
xowl/request.php in Ximdex 4.0 has XSS via the content parameter...
CVE-2018-11670: Cross-Site Request Forgery (CSRF)
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary PHP code via the content parameter to index.php?m=admin&c=media&a=fileconnect...
CVE-2018-8805
Yxcms building system compatible cell phone v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extendguestbook.php or protected\apps\default\view\mobile\extendguestbook.php in an index.php?r=default/column/index&col=guestbook request...
CVE-2018-8805
Yxcms building system compatible cell phone v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extendguestbook.php or protected\apps\default\view\mobile\extendguestbook.php in an index.php?r=default/column/index&col=guestbook request...
CVE-2018-8805: Improper Neutralization of Input During Web Page Generation
Yxcms building system compatible cell phone v1.4.7 has XSS via the content parameter to protected\apps\default\view\default\extendguestbook.php or protected\apps\default\view\mobile\extendguestbook.php in an index.php?r=default/column/index&col=guestbook request...
CVE-2017-17407
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager v7.2.699 build 1001. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the content parameter provided ...
CVE-2017-17407: Improper Neutralization of Special Elements used in an OS Command
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager v7.2.699 build 1001. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the content parameter provided ...
NetGain Enterprise Manager Command Execution Vulnerability
Netgain Enterprise Manager is a suite of IT asset monitoring and management software from NetGain Systems, Singapore. A command execution vulnerability exists in the handling of the 'content' parameter in NetGain Enterprise Manager. A remote attacker could exploit this vulnerability to execute...
CVE-2017-16903: Improper Limitation of a Pathname to a Restricted Directory
LvyeCMS through 3.1 allows remote attackers to upload and execute arbitrary PHP code via directory traversal sequences in the dir parameter, in conjunction with PHP code in the content parameter, within a template Style add request to index.php...
CVE-2017-15987
Fake Magazine Cover Script allows SQL Injection via the rate.php value parameter or the content.php id parameter...
SQL Injection Vulnerability in DBShop search_content Parameter
DBShop based on PHP official ZendFramework 2 framework for the development of a new generation of e-commerce system perfect support for PHP7. A SQL injection vulnerability exists in the DBShop searchcontent parameter, due to the program failing to filter user input data. An attacker can exploit...
SQL Injection Vulnerability in List_content Parameter of SMiCMS Government Website System
State Micro CMS for one of the country's most mainstream CMS systems, but also in southern China in the field of PHP open source platform provider. State Micro CMS government website system listcontent parameter SQL injection vulnerability , the vulnerability is due to the failure of the user to...
SQL Injection Vulnerability in the Content Parameter of smsreportxiang.jsp File on ECS Customer Management Platform
Enterprise letter is the use of java development of a special tailored to the enterprise customer value-added SMS business, enterprise customers in the use of computers at the same time can be completed with the production of office combined with the internal SMS communication. SQL injection...
Fiyo CMS Arbitrary File Upload Vulnerability
Fiyo CMS is a content management system CMS for creating CMS templates. A security vulnerability exists in Fiyo CMS versions 2.x through 2.0.7. The vulnerability can be exploited by an attacker to execute code by sending the 'content' parameter to the file /dapur/apps/apptheme/libs/savefile.php...
Code injection
In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/apptheme/libs/savefile.php" and then execute code...
CVE-2017-7625
In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/apptheme/libs/savefile.php" and then execute code...
CVE-2017-7625
In Fiyo CMS 2.x through 2.0.7, attackers may upload a webshell via the content parameter to "/dapur/apps/apptheme/libs/savefile.php" and then execute code...
Subrion CMS Cross-Site Request Forgery Vulnerability (CNVD-2017-04653)
Subrion CMS is a PHP-based content management system CMS developed by the Subrion team. The system can be integrated into a website and supports a wide range of extensions plug-ins and more. A cross-site request forgery vulnerability exists in admin/blocks/add/URI in Subrion CMS version 4.0.5. An...
CVE-2017-6068: Cross-Site Request Forgery (CSRF)
Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block, and can optionally insert XSS via the content parameter...