Campaign Monitor for WordPress - Information Disclosure Detection

Campaign Monitor for WordPress plugin for WordPress versions up to 2.8.15 contains a full path disclosure caused by improper access restriction and enabled displayerrors in /forms/views/admin/create.php, letting unauthenticated attackers retrieve server paths, exploit requires displayerrors to be...

CVE-2024-6569: Exposure of Sensitive Information to an Unauthorized Actor

The Campaign Monitor for WordPress plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.8.15. This is due the plugin not properly restricting direct access to /forms/views/admin/create.php and displayerrors being enabled. This makes it possible for...

EasyAnswer 1.0.1 Cross Site Request Forgery

==================================================================================================================================== | Title : EasyAnswer version 1.0.1 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 114.0.164-bit | |...

CVE-2021-43484

A Remote Code Execution RCE vulnerability exists in Simple Client Management System 1.0 in create.php due to the failure to validate the extension of the file being sent in a request...

CVE-2021-43484: Improper Neutralization of Special Elements used in an SQL Command

A Remote Code Execution RCE vulnerability exists in Simple Client Management System 1.0 in create.php due to the failure to validate the extension of the file being sent in a request...

Simple Client Management System SQL Injection Vulnerability

Simple Client Management System is a simple client management system by Carlo Montero Personal Developer. A security vulnerability exists in Simple Client Management System 1.0 in create.php due to a Remote Code Execution RCE vulnerability due to an inability to validate the extension of a file...

PT-2022-11857

Name of the Vulnerable Software and Affected Versions Simple Client Management System version 1.0 Description A Remote Code Execution RCE issue exists due to the failure to validate the extension of the file being sent in a request to the create.php file. Recommendations For Simple Client...

CVE-2015-1583

Multiple cross-site request forgery CSRF vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that 1 create an administrator account via a request to mods/core/users/admins/create.php or 2 create a user account via a request to...

CVE-2015-1583: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in ATutor 2.2 allow remote attackers to hijack the authentication of administrators for requests that 1 create an administrator account via a request to mods/core/users/admins/create.php or 2 create a user account via a request to...

PT-2020-7806

Name of the Vulnerable Software and Affected Versions: ATutor version 2.2 Description: The issue allows remote attackers to hijack the authentication of administrators for requests that create an administrator account via a request to "mods/ core/users/admins/create.php" or create a user account...

Cross site request forgery (csrf)

BlackCat CMS 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted newmodulename parameter to backend/addons/ajaxcreate.php. NOTE: this can be exploited via CSRF...

PT-2017-13222

Name of the Vulnerable Software and Affected Versions BlackCat CMS version 1.2 Description The issue allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new modulename parameter to the "backend/addons/ajax create.php" endpoint. This can be exploited via CSRF...

CVE-2017-9449: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/modules/views/create.php. The attacker creates a crafted table name at admin/developer/modules/views/create/ and the injection is visible ...

CVE-2017-9427: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core\admin\modules\developer\modules\designer\form-create.php. The attacker creates a crafted table name at admin/developer/modules/designer/ and the injection is...

PT-2015-6668

Name of the Vulnerable Software and Affected Versions FiverrScript version 7.2 Description A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that create a new admin via a request to "administrator/admins create.php". Recommendations For...

thinksaas最新版xss

简要描述： thinksaas最新版xss 详细说明： 漏洞文件：\app\group\action\create.php case "do": if$TSAPP'options''iscreate' == 0 || $TSUSER'user''isadmin'==1 $groupname = trim$POST'groupname';//这里没有过滤 $groupdesc = tsClean$POST'groupdesc';//重点函数tsClean过滤了 if$groupname=='' || $groupdesc=='' tsNotice'小组名称和介绍不能为空！'; //过滤内容...

PT-2014-4436

Name of the Vulnerable Software and Affected Versions vBulletin versions 4.2.2, 4.2.1, 4.2.0 PL2, and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the conceptid argument in an xmlrpc API request to the...

PT-2014-6071

Name of the Vulnerable Software and Affected Versions Lunar CMS versions prior to 3.3-3 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for specific requests. This...

vCard PRO 0 create.php card_id Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/18699/info VCard PRO is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. A successful exploit...

vCard PRO 3.1 - Cross Site Scripting Vulnerability

No description provided by source. ======================================================================================== | Title : vCard PRO 3.1 Cross Site Scripting Vulnerability | | Author : indoushka | | email : [email protected] | | Home : Souk Naamane - 04325 - Oum El Bouaghi - Algeri...