CVE-2022-24220

eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/editpost.php...

CVE-2022-24220

eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/editpost.php...

Elite Graphix Elite Cms SQL注入漏洞

Elite Graphix Elite Cms is a web content management written in Php language from Elite Graphix India. platform for storing and organizing information and documents. Elite Graphix Elite Cms suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL...

CVE-2021-25976: Cross-Site Request Forgery (CSRF)

In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery CSRF when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known...

Custom Banners < 3.3 - CSRF Nonce Bypass in saveCustomFields

The plugin did not properly check the CSRF nonce in the saveCustomFields method, which could allow attackers to make a logged in user with the editpost capability to save custom fields in a post. Numerous sanitisation fixes were also added to v3.3 PoC Send a request without the...

Online News Portal System 1.0 Cross Site Scripting

Exploit Title: Online News Portal System 1.0 - 'Title' Stored Cross Site Scripting Date: 24-11-2020 Exploit Author: Parshwa Bhavsar Vendor Homepage: https://www.sourcecodester.com/php/14600/online-news-portal-using-phpmysqli-source-code.html Software Link:...

CVE-2019-19984

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with editpost capabilities to manage plugin settings and email campaigns...

PT-2018-15150

Name of the Vulnerable Software and Affected Versions ThinkCMF version X2.2.2 Description The issue concerns a SQL Injection problem via the edit post method in ArticleController.class.php. It can be exploited by normal authenticated users through the postid1 parameter in an article edit post...

ThinkCMF SQL Injection Vulnerability (CNVD-2019-07960)

ThinkCMF is a Chinese content management framework based on PHP+MYSQL. An SQL injection vulnerability exists in the editpost function in NavController.class.php in ThinkCMF X2.2.2, which can be exploited by users with administrator privileges to perform SQL injection attacks via the parentid...

PT-2018-15147

Name of the Vulnerable Software and Affected Versions ThinkCMF version X2.2.2 Description The issue is related to SQL Injection via the edit post function in NavController.class.php. It can be exploited with manager privilege using the parentid parameter in a "nav" action. Recommendations For...

ekobroucek.cz Cross Site Request Forgery vulnerability

Open Bug Bounty ID: OBB-656150 Description| Value ---|--- Affected Website:| ekobroucek.cz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| CSRF Cross-Site Request Forgery / CWE-352 CVSSv3 Score:| 8.8...

rondony.cz Cross Site Request Forgery vulnerability

Open Bug Bounty ID: OBB-655177 Description| Value ---|--- Affected Website:| rondony.cz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| CSRF Cross-Site Request Forgery / CWE-352 CVSSv3 Score:| 8.8...

Bludit Cross-Site Scripting Vulnerability

Bludit is an open source free lightweight blog CMS Content Management System system. new page, new category and edit post function body message context are among the functional modules. new page is a new page to add modules. new category is a new category to add modules . new page is a new page a...

CVE-2017-16636

In Bludit v1.5.2 and v2.0.1, an XSS vulnerability is located in the new page, new category, and edit post function body message context. Remote attackers are able to bypass the basic editor validation to trigger cross site scripting. The XSS is persistent and the request method to inject via edit...

Wordpress Levo-Slideshow v2.3 - Persistent Vulnerability

Document Title: =============== Wordpress Levo-Slideshow v2.3 - Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1855 Release Date: ============= 2016-06-05 Vulnerability Laboratory ID VL-ID: ====================================...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of administrators for requests that 1 ban a user via the username parameter in a dobanuser action to modcp/banning.php or 2 unban a user, 3 modify...

CVE-2014-9438

Cross-site request forgery CSRF vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of administrators for requests that 1 ban a user via the username parameter in a dobanuser action to modcp/banning.php or 2 unban a user, 3 modify...

CVE-2011-5106

Cross-site scripting XSS vulnerability in edit-post.php in the Flexible Custom Post Type plugin before 0.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter...

Mingle Forum SQL Injection / Bypass

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 1. Advisory Information Title: Multiple Vulnerabilities in Mingle Forum WordPress Plugin Advisory URL: http://www.charleshooper.net/advisories/ Date Published: January 8th, 2011 Vendors Contacted: Paul Carter - Maintainer of plugin. 2. Summary Mingle...

WordPress Plugin mingle forum 1.0.26 - Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 1. Advisory Information Title: Multiple Vulnerabilities in Mingle Forum WordPress Plugin Advisory URL: http://www.charleshooper.net/advisories/ Date Published: January 8th, 2011 Vendors Contacted: Paul Carter - Maintainer of plugin. 2. Summary Mingle...