6 matches found
Cross site request forgery (csrf)
EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page...
CVE-2019-12361
EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page...
CVE-2019-12362: Improper Neutralization of Input During Web Page Generation
EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php...
CVE-2019-12361: Improper Neutralization of Input During Web Page Generation
EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page...
Default credentials
controller/fetchpwd.php and controller/doAction.php in HotelsServer through 2018-11-05 rely on base64 in an attempt to protect password storage...
CVE-2019-7648: Inadequate Encryption Strength
controller/fetchpwd.php and controller/doAction.php in HotelsServer through 2018-11-05 rely on base64 in an attempt to protect password storage...