91 matches found
PT-2018-14330
Name of the Vulnerable Software and Affected Versions tecrail Responsive FileManager version 9.8.1 Description A reflected XSS issue allows remote attackers to inject arbitrary web script or HTML. This occurs in the dialog.php file. Recommendations For tecrail Responsive FileManager version 9.8.1...
PT-2017-14241
Name of the Vulnerable Software and Affected Versions Pootle Button plugin versions prior to 1.2.0 Description The issue allows for XSS exploitation via the assets url parameter in "assets/dialog.php", which can be accessed through the "/wp-admin/admin-ajax.php" API endpoint. Recommendations For...
CVE-2017-15811: Improper Neutralization of Input During Web Page Generation
The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assetsurl parameter in assets/dialog.php, exploitable via wp-admin/admin-ajax.php...
Type confusion
The "Smart related articles" extension 1.1 for Joomla! has XSS in dialog.php nart,type in GET Method...
Sql injection
The "Smart related articles" extension 1.1 for Joomla! has SQL injection in dialog.php attacker must use searchcats variable in POST method to exploit this vulnerability...
CVE-2017-7627
The "Smart related articles" extension 1.1 for Joomla! does not prevent direct requests to dialog.php there is a missing JEXEC check...
CVE-2017-7628
The "Smart related articles" extension 1.1 for Joomla! has SQL injection in dialog.php attacker must use searchcats variable in POST method to exploit this vulnerability...
CVE-2017-7626
The "Smart related articles" extension 1.1 for Joomla! has XSS in dialog.php nart,type in GET Method...
CVE-2017-7627
The "Smart related articles" extension 1.1 for Joomla! does not prevent direct requests to dialog.php there is a missing JEXEC check...
CVE-2017-7626
The "Smart related articles" extension 1.1 for Joomla! has XSS in dialog.php nart,type in GET Method...
CVE-2017-7627
The "Smart related articles" extension 1.1 for Joomla! does not prevent direct requests to dialog.php there is a missing JEXEC check...
CVE-2017-7628
The "Smart related articles" extension 1.1 for Joomla! has SQL injection in dialog.php attacker must use searchcats variable in POST method to exploit this vulnerability...
PT-2017-17856
Name of the Vulnerable Software and Affected Versions Joomla "Smart related articles" extension version 1.1 Description The issue concerns SQL injection in the dialog.php file of the "Smart related articles" extension for Joomla. An attacker must use the search cats variable in the POST method to...
CVE-2017-7628: Improper Neutralization of Special Elements used in an SQL Command
The "Smart related articles" extension 1.1 for Joomla! has SQL injection in dialog.php attacker must use searchcats variable in POST method to exploit this vulnerability...
CVE-2017-7627: Undefined Security Weakness
The "Smart related articles" extension 1.1 for Joomla! does not prevent direct requests to dialog.php there is a missing JEXEC check...
PT-2017-17854
Name of the Vulnerable Software and Affected Versions Joomla "Smart related articles" extension version 1.1 Description The issue concerns a XSS problem in the dialog.php file of the "Smart related articles" extension for Joomla, specifically affecting the n art and type variables in the GET...
PT-2017-17855
Name of the Vulnerable Software and Affected Versions Joomla "Smart related articles" extension version 1.1 Description The issue concerns a missing JEXEC check in the dialog.php file of the "Smart related articles" extension for Joomla, allowing direct requests to this file. Recommendations For...
CVE-2017-7626: Improper Neutralization of Input During Web Page Generation
The "Smart related articles" extension 1.1 for Joomla! has XSS in dialog.php nart,type in GET Method...
PT-2017-17405
Name of the Vulnerable Software and Affected Versions concrete5 versions prior to 5.6.3.4 Description The issue is caused by insufficient filtration of user-supplied data, specifically the disable choose parameter, passed to the "concrete5-legacy-master/web/concrete/tools/files/search dialog.php"...
CVE-2017-5961: Improper Neutralization of Input During Web Page Generation
An issue was discovered in ionize through 1.0.8. The vulnerability exists due to insufficient filtration of user-supplied data in the "path" HTTP GET parameter passed to the "ionize-master/themes/admin/javascript/tinymce/jscripts/tinymce/plugins/codemirror/dialog.php" URL. An attacker could execu...