CVE-2018-10516

In CMS Made Simple CMSMS through 2.2.7, the "file rename" operation in the admin dashboard contains a sensitive information disclosure vulnerability, exploitable by an admin user, that can cause DoS by moving config.php to the upload/ directory...

CVE-2018-10522

CMS Made Simple (CMSMS) up to version 2.2.7 contains an information-disclosure vulnerability in the admin dashboard’s file view operation. The issue arises because the PHP file_get_contents function is exposed without access restrictions, allowing ordinary users to read arbitrary files. The cited...

CVE-2018-10520

In CMS Made Simple CMSMS through 2.2.7, the "module remove" operation in the admin dashboard contains an arbitrary file deletion vulnerability that can cause DoS, exploitable by an admin user, because the attacker can remove all lib/ files in all directories...

CVE-2018-10515

In CMS Made Simple CMSMS through 2.2.7, the "file unpack" operation in the admin dashboard contains a remote code execution vulnerability exploitable by an admin user because a .php file can be present in the extracted ZIP archive...

CVE-2018-10517

In CMS Made Simple CMSMS through 2.2.7, the "module import" operation in the admin dashboard contains a remote code execution vulnerability, exploitable by an admin user, because an XML Package can contain base64-encoded PHP code in a data element...

CVE-2018-10515

CMS Made Simple (CMSMS) up to version 2.2.7 is affected by a remote code execution vulnerability in the admin dashboard’s file unpack operation. The underlying issue is that the extracted ZIP archive may contain a .php file, which an admin user can trigger to execute code on the server. If unpatc...

CVE-2018-10517

CVE-2018-10517 concerns CMS Made Simple (CMSMS) up to version 2.2.7. The vulnerability lies in the admin dashboard’s “module import” operation, where an XML Package can include a data element with base64-encoded PHP code, enabling a remote code execution when exploited by an authenticated adminis...

WSO2 Identity Server dashboard cross-site scripting vulnerability

WSO2 Identity Server is a U.S. WSO2 company's open source identity services , it supports Information Cards, OpenID and XACML identity framework. dashboard is one of the dashboard components. A cross-site scripting vulnerability exists in dashboard in WSO2 Identity Server version 5.5.0. A remote...

Cross site scripting

WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers...

CVE-2018-8716

WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers...

CVE-2018-8716

WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers...

CVE-2018-8716

WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers...

CVE-2018-8716

CVE-2018-8716 is a stored cross-site scripting vulnerability in WSO2 Identity Server dashboard prior to version 5.5.0. The issue allows low-privilege attackers to inject arbitrary scripts via the dashboard (text inputs), with exploitation described as XSS via the dashboard. The fixed version is 5...

CVE-2018-8716

WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers...

DRUPAL-CONTRIB-2018-022

This module enables you to monitor and manage any number of remote Drupal sites and aggregate useful information for administrators in a central dashboard. The modules DRD and DRD Agent encrypt the data which is exchanged between them but in order to do so, they use the PHP serialize/unserialize...

Blog Master Pro 1.0 - CSV Injection

Exploit Title: Blog Master Pro v1.0 - CSV Injection Date: 2018-04-23 Exploit Author: 8bitsec CVE: CVE-2018-10255 Vendor Homepage: https://codecanyon.net/ Software Link: https://codecanyon.net/item/blog-master-pro/21689781 Version: 1.0 Tested on: Kali Linux 2.0 | Mac OS 10.13 Release Date:...

WSO2 Identity Server 5.3.0 Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Stored XSS Vulnerabilities product: WSO2 Carbon, WSO2 Dashboard Server vulnerable version: WSO2 Identity Server 5.3.0 fixed version: WSO2 Identity Server 5.5.0 C...

WSO2 Identity Server 5.3.0 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications ======================================================================= title: Multiple Stored XSS Vulnerabilities product: WSO2 Carbon, WSO2 Dashboard Server vulnerable version: WSO2 Identity Server 5.3.0 fixed version: WSO2 Identity Server...

WSO2 Carbon WSO2 Dashboard Server 5.3.0 - Persistent Cross-Site Scripting

WSO2 Carbon WSO2 Dashboard Server 5.3.0 - Persistent Cross-Site Scripting SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Stored XSS Vulnerabilities product: WSO2 Carbon, WSO2 Dashboard Server vulnerable...

WSO2 Carbon / WSO2 Dashboard Server 5.3.0 - Persistent Cross-Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Stored XSS Vulnerabilities product: WSO2 Carbon, WSO2 Dashboard Server vulnerable version: WSO2 Identity Server 5.3.0 fixed version: WSO2 Identity Server 5.5.0 C...