78 matches found
ThinkAdmin 6 Arbitrary File Read
Exploit Title: ThinkAdmin 6 - Arbitrarily File Read Google Dork: N/A Date: 2020-09-14 Exploit Author: Hzllaga Vendor Homepage: https://github.com/zoujingli/ThinkAdmin/ Software Link: Before https://github.com/zoujingli/ThinkAdmin/commit/ff2ab47cfabd4784effbf72a2a386c5d25c43a9a Version: v6 =...
CVE-2020-10437
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/optimize-database.php by adding a question mark ? followed by the payload...
Cross site scripting
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/optimize-database.php by adding a question mark ? followed by the payload...
CVE-2020-10437
CVE-2020-10437 affects Chadha PHPKB Standard Multi-Language 9. The Red Hat records confirm that URIs handled in admin/header.php allow Reflected XSS by injecting a payload after a question mark, affecting admin/add-article.php, admin/trash-box.php, and admin/optimize-database.php via the same pat...
Cross-site Request Forgery (CSRF)
Overview phppgadmin/phppgadmin is a web-based administration tool for PostgreSQL. It is perfect for PostgreSQL DBAs, newbies, and hosting services. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF. Multiple areas within the application allows sensitive actions t...
Information disclosure
doorGets 7.0 has a sensitive information disclosure vulnerability in /setup/temp/admin.php and /setup/temp/database.php. A remote unauthenticated attacker could exploit this vulnerability to obtain the administrator password...
CVE-2019-11616
CVE-2019-11616 affects doorGets 7.0. The vulnerability is a sensitive information disclosure in /setup/temp/admin.php and /setup/temp/database.php, allowing a remote unauthenticated attacker to obtain the administrator password. Affected software: doorGets 7.0 (web CMS). Root cause and vector det...
CVE-2019-8425
includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages...
CVE-2019-8425
includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages...
CVE-2019-8425
includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages...
CVE-2019-8425
includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages...
CVE-2019-5886
An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lock file in the Add method, which allows an attacker to reinstall the database. The attacker can write arbitrary code to database.php during system reinstallation...
CVE-2018-19433
ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $curlang value...
Design/Logic Flaw
ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $curlang value...
CVE-2018-19433
ShowDoc 2.4.1 has XSS via the lang parameter because install/database.php mishandles the $curlang value...
Code injection
statics/app/index/controller/Install.php in YUNUCMS 1.1.5 if install.lock is not present allows remote attackers to execute arbitrary PHP code by placing this code in the index.php?s=index/install/setup2 DBPREFIX field, which is written to database.php...
CVE-2018-19180
statics/app/index/controller/Install.php in YUNUCMS 1.1.5 if install.lock is not present allows remote attackers to execute arbitrary PHP code by placing this code in the index.php?s=index/install/setup2 DBPREFIX field, which is written to database.php...
CVE-2018-19180
statics/app/index/controller/Install.php in YUNUCMS 1.1.5 if install.lock is not present allows remote attackers to execute arbitrary PHP code by placing this code in the index.php?s=index/install/setup2 DBPREFIX field, which is written to database.php...
Sql injection
An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI...
CVE-2018-12912
An issue wan discovered in admin\controllers\database.php in HongCMS 3.0.0. There is a SQL Injection vulnerability via an admin/index.php/database/operate?dbaction=emptytable&tablename= URI...