8 matches found
Cross site request forgery (csrf)
EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page...
CVE-2019-12361
EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page...
PT-2019-12764
Name of the Vulnerable Software and Affected Versions EmpireCMS version 7.5.0 Description The issue allows for XSS via the HTTP Referer header to the "e/member/doaction.php" endpoint. Recommendations For EmpireCMS version 7.5.0, update to a version that fixes this issue, or as a temporary...
CVE-2019-12361: Improper Neutralization of Input During Web Page Generation
EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page...
CVE-2019-12362: Improper Neutralization of Input During Web Page Generation
EmpireCMS 7.5.0 has XSS via the HTTP Referer header to e/member/doaction.php...
PT-2019-12763
Name of the Vulnerable Software and Affected Versions EmpireCMS version 7.5.0 Description The issue allows for XSS via the from parameter to "e/member/doaction.php". This can be exploited using a CSRF payload to change the dynamic page template. An attacker can resend the...
Default credentials
controller/fetchpwd.php and controller/doAction.php in HotelsServer through 2018-11-05 rely on base64 in an attempt to protect password storage...
CVE-2019-7648: Inadequate Encryption Strength
controller/fetchpwd.php and controller/doAction.php in HotelsServer through 2018-11-05 rely on base64 in an attempt to protect password storage...