714 matches found
CVE-2020-8865
This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within edit.php. When parsing the paramstemplate parameter, the process doe...
CVE-2020-8865
This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within edit.php. When parsing the paramstemplate parameter, the process doe...
CVE-2020-8865: Relative Path Traversal
This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within edit.php. When parsing the paramstemplate parameter, the process doe...
PT-2020-20336 · Horde · Horde Groupware Webmail Edition
Name of the Vulnerable Software and Affected Versions: Horde Groupware Webmail Edition version 5.2.22 Description: This issue allows remote attackers to execute local PHP files on affected installations. Authentication is required to exploit this issue. The specific flaw exists within the edit.ph...
PT-2020-7208
Name of the Vulnerable Software and Affected Versions Axous versions 1.1.1 and earlier Description Multiple cross-site request forgery CSRF and cross-site scripting XSS issues allow remote attackers to hijack the authentication of administrators for requests. This can be done via various paramete...
PT-2020-6773
Name of the Vulnerable Software and Affected Versions Online Book Store version 1.0 Description The issue is related to a SQL Injection vulnerability in the admin edit.php script, specifically via the bookisbn parameter. This could allow a remote malicious user to execute arbitrary code. The...
PT-2020-10390
Name of the Vulnerable Software and Affected Versions PHP Scripts Mall advanced-real-estate-script version 4.0.9 Description The issue concerns a SQL Injection vulnerability. Specifically, the news id parameter in the news edit.php script is vulnerable. Recommendations For version 4.0.9, avoid...
CVE-2013-1420
Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to backup-edit.php; 2 title or 3 menu parameter to edit.php; or 4 path or 5 returnid parameter to filebrowser.php in admin/. NOTE: t...
PT-2020-7349
Name of the Vulnerable Software and Affected Versions: GetSimple CMS versions prior to 3.2.1 Description: The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters, including the id parameter to "backup-edit.php", the title or menu...
CVE-2013-1420: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to backup-edit.php; 2 title or 3 menu parameter to edit.php; or 4 path or 5 returnid parameter to filebrowser.php in admin/. NOTE: t...
PT-2019-15835
Name of the Vulnerable Software and Affected Versions FusionPBX version 4.4.1 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the dialplan uuid parameter in the /app/dialplans/dialplan detail edit.php endpoint. Recommendations For...
CVE-2015-9425
The social-locker plugin before 4.2.5 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?posttype=opanda-item&page=license-manager-sociallocker-next licensekey parameter...
PT-2019-7384
Name of the Vulnerable Software and Affected Versions Social-locker plugin versions prior to 4.2.5 for WordPress Description The issue concerns a CSRF with resultant XSS in the social-locker plugin for WordPress. This occurs via the licensekey parameter in the "/wp-admin/edit.php?post...
CVE-2015-9434: Cross-Site Request Forgery (CSRF)
The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?posttype=kwlogos&page=kwlogossettings tab or tabflagsorder parameter...
PT-2019-7393
Name of the Vulnerable Software and Affected Versions kiwi-logo-carousel plugin versions prior to 1.7.2 Description The issue concerns a CSRF vulnerability that can lead to XSS. It is exploitable via the "wp-admin/edit.php" endpoint, specifically through the post type, page, tab, or tab flags ord...
Sql injection
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used...
CVE-2019-16696
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used...
CVE-2019-16696: Improper Neutralization of Special Elements used in an SQL Command
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used...
PT-2019-7347
Name of the Vulnerable Software and Affected Versions mtouch-quiz plugin versions prior to 3.1.3 for WordPress Description The issue concerns a CSRF Cross-Site Request Forgery vulnerability in the wp-admin/edit.php endpoint, which can lead to XSS Cross-Site Scripting. This allows an attacker to...