CVE-2019-7345: Improper Neutralization of Input During Web Page Generation

Self - Stored Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, as the view 'options' options.php does no input validation for the WEBTITLE, HOMEURL, HOMECONTENT, or WEBCONSOLEBANNER value, allowing an attacker to execute HTML or JavaScript code. This relates to functions.php...

PT-2019-19029

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.3 Description The issue allows command injection via shell metacharacters in the daemonControl function, located in includes/functions.php. Recommendations For versions prior to 1.32.3, update to version 1.32....

CVE-2018-19559

CuppaCMS before 2018-11-12 has SQL Injection in administrator/classes/ajax/functions.php via the referenceid parameter...

CVE-2018-19559

CuppaCMS before 2018-11-12 has SQL Injection in administrator/classes/ajax/functions.php via the referenceid parameter...

PT-2018-15004

Name of the Vulnerable Software and Affected Versions CuppaCMS versions prior to 2018-11-12 Description The issue is related to SQL Injection. It affects the administrator/classes/ajax/functions.php file via the reference id parameter. Recommendations For versions prior to 2018-11-12, update to a...

CVE-2018-19559: Improper Neutralization of Special Elements used in an SQL Command

CuppaCMS before 2018-11-12 has SQL Injection in administrator/classes/ajax/functions.php via the referenceid parameter...

PT-2018-14954

Name of the Vulnerable Software and Affected Versions GetSimpleCMS version 3.3.15 Description The issue allows HTML execution through alternative file uploads. This can occur with files having no extension or unrecognized extensions, such as 'test' or 'test.asdf', due to vulnerabilities in...

WordPress 4.5.x < 4.5.12 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...

WordPress 3.9.x < 3.9.15 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the PHPMailer component in the class.phpmailer.php script due to improper handling of sender email addresses. An...

WordPress 4.7.x < 4.7.8 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...

WordPress 3.7.x < 3.7.24 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - wp-admin/user-new.php sets the newbloguser key to a string that can be directly derived from the user ID, which allows remote attackers to bypass intended access...

Remote code execution

The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated remote code execution due to a default component that permits arbitrary upload of PHP files, because the formmailer widget blocks .php files but not .php5 or .phtml files. This is related t...

PT-2018-12259

Name of the Vulnerable Software and Affected Versions Zeta Producer Desktop CMS versions prior to 14.2.1 Description The issue allows for unauthenticated remote code execution due to a default component that permits arbitrary upload of PHP files. This is possible because the formmailer widget...

PT-2018-10767

Name of the Vulnerable Software and Affected Versions wpForo Forum plugin versions prior to 1.4.12 Description The issue allows Unauthenticated Reflected Cross-Site Scripting XSS via the URI. This is due to the wpforo get request uri function in wpf-includes/functions.php. Recommendations For...

CVE-2018-10059

Cacti before 1.1.37 has XSS because the getcurrentpage function in lib/functions.php relies on $SERVER'PHPSELF' instead of $SERVER'SCRIPTNAME' to determine a page name...

CVE-2018-10060

Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitizeuri function in lib/functions.php...

CVE-2018-10059

Cacti before 1.1.37 has XSS because the getcurrentpage function in lib/functions.php relies on $SERVER'PHPSELF' instead of $SERVER'SCRIPTNAME' to determine a page name...

CVE-2018-10060

Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitizeuri function in lib/functions.php...

CVE-2018-10059

Cacti before 1.1.37 has XSS because the getcurrentpage function in lib/functions.php relies on $SERVER'PHPSELF' instead of $SERVER'SCRIPTNAME' to determine a page name...

CVE-2018-10060: Improper Neutralization of Input During Web Page Generation

Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitizeuri function in lib/functions.php...