PT-2018-9799

Name of the Vulnerable Software and Affected Versions: CliqueMania loja virtual version 14 Description: The issue is related to SQL Injection, which occurs via the id parameter in a recomendar action, specifically in the patch/remote.php endpoint. Recommendations: For version 14, avoid using the ...

CVE-2018-9153

The plugin upload component in Z-BlogPHP 1.5.1 allows remote attackers to execute arbitrary PHP code via the appid parameter to zbusers/plugin/AppCentre/pluginedit.php because of an unanchored regular expression, a different vulnerability than CVE-2018-8893. The component must be accessed directl...

CVE-2018-9169

Z-BlogPHP 1.5.1 has XSS via the zbusers/plugin/AppCentre/pluginedit.php appid parameter. The component must be accessed directly by an administrator, or through CSRF...

Z-BlogPHP Cross-Site Scripting Vulnerability (CNVD-2018-08697)

Z-BlogPHP is an open source PHP-based blogging system developed by the Z-Blog community. A cross-site scripting vulnerability exists in Z-BlogPHP version 1.5.1. A remote attacker can exploit this vulnerability by sending the 'appid' parameter to the zbusers/plugin/AppCentre/pluginedit.php file to...

Z-BlogPHP Arbitrary PHP Code Execution Vulnerability

Z-BlogPHP is an open source PHP-based blog system developed by the Z-Blog community. plugin upload component is one of the plugin upload components. A security vulnerability exists in the plugin upload component in Z-BlogPHP version 1.5.1. A remote attacker can exploit this vulnerability by sendi...

PT-2018-19074

Name of the Vulnerable Software and Affected Versions Gxlcms QY version 1.0.0713 Description The issue allows remote attackers to delete any file via directory traversal sequences in the id parameter of an "Admin-Data-del" request. This is due to a vulnerability in the...

CVE-2018-9309: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in a dl/dlsendsms.php request...

Scilico I, Librarian 'id' Parameter Cross-Site Scripting Vulnerability

Scilico I, Librarian is the United States Scilico company a set of online PDF document management system. A cross-site scripting vulnerability exists in the 'id' parameter of the stable.php file in Scilico I, Librarian 4.8 and earlier versions. A remote attacker can exploit this vulnerability to...

CVE-2018-8967: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in zzcms 8.2. It allows SQL injection via the id parameter in an adv2.php?action=modify request...

PT-2018-18746 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: The issue allows SQL injection via the id parameter in an "adv2.php?action=modify" request. Recommendations: For zzcms version 8.2, avoid using the id parameter in the "adv2.php?action=modify" request until the...

Cross site scripting

I, Librarian version 4.8 and earlier contains a Cross Site Scripting XSS vulnerability in "id" parameter in stable.php that can result in an attacker using the XSS to send a malicious script to an unsuspecting user...

CVE-2018-1000139: Improper Neutralization of Input During Web Page Generation

I, Librarian version 4.8 and earlier contains a Cross Site Scripting XSS vulnerability in "id" parameter in stable.php that can result in an attacker using the XSS to send a malicious script to an unsuspecting user...

PT-2018-9312

Name of the Vulnerable Software and Affected Versions: I, Librarian versions 4.8 and earlier Description: The issue concerns a Cross Site Scripting XSS vulnerability. This vulnerability is located in the id parameter of the stable.php file. It allows an attacker to send a malicious script to an...

CVE-2018-1000081: Improper Input Validation

Ajenti version version 2 contains a Input Validation vulnerability in ID string on Get-values POST request that can result in Server Crashing. This attack appear to be exploitable via An attacker can freeze te server by sending a giant string to the ID parameter...

PT-2018-9260

Name of the Vulnerable Software and Affected Versions: Ajenti version 2 Description: The issue is related to an Input Validation vulnerability in the ID string on Get-values POST request, which can cause Server Crashing. An attacker can exploit this by sending a large string to the ID parameter,...

ASANHAMAYESH CMS SQL Injection Vulnerability

ASANHAMAYESH CMS is a content management system. files component is one of the files components. A SQL injection vulnerability exists in the files.php file of the files component in ASANHAMAYESH CMS version 3.4.6. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...

CVE-2018-7463

SQL injection vulnerability in files.php in the "files" component in ASANHAMAYESH CMS 3.4.6 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter...

PT-2018-18082

Name of the Vulnerable Software and Affected Versions ASANHAMAYESH CMS version 3.4.6 Description A SQL injection issue exists in the files.php file of the "files" component, allowing a remote attacker to execute arbitrary SQL commands. The id parameter is vulnerable to this issue. Recommendations...

CVE-2018-7463: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in files.php in the "files" component in ASANHAMAYESH CMS 3.4.6 allows a remote attacker to execute arbitrary SQL commands via the "id" parameter...

CVE-2018-7476

controllers/admin/Linkage.php in dayrui FineCms 5.3.0 has Cross Site Scripting XSS via the id or lid parameter in a c=linkage,m=import request to admin.php, because the xssclean protection mechanism is defeated by crafted input that lacks a '' character...