CVE-2020-23691: Undefined Security Weakness

YFCMF v2.3.1 has a Remote Command Execution RCE vulnerability in the index.php...

PT-2021-10927

Name of the Vulnerable Software and Affected Versions YFCMF version 2.3.1 Description The issue is related to a Remote Command Execution RCE vulnerability. It affects the index.php file. Recommendations For YFCMF version 2.3.1, at the moment, there is no information about a newer version that...

CVE-2021-31537

SIS SIS-REWE Go before 7.7 SP17 allows XSS: rewe/prod/web/index.php affected parameters are config, version, win, db, pwd, and user and /rewe/prod/web/rewegocheck.php version and all other parameters...

PT-2021-19410

Name of the Vulnerable Software and Affected Versions SIS SIS-REWE Go versions prior to 7.7 SP17 Description The issue allows for XSS attacks. It affects the 'rewe/prod/web/index.php' endpoint, with vulnerable parameters being config, version, win, db, pwd, and user. Additionally, the...

CVE-2021-31537: Improper Neutralization of Input During Web Page Generation

SIS SIS-REWE Go before 7.7 SP17 allows XSS: rewe/prod/web/index.php affected parameters are config, version, win, db, pwd, and user and /rewe/prod/web/rewegocheck.php version and all other parameters...

CVE-2020-23376: Cross-Site Request Forgery (CSRF)

NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parameter to launch a stored XSS attack...

Cross site scripting

A stored cross-site scripting XSS vulnerability in SourceCodester Budget Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php via vulnerable field 'Budget Title'...

CVE-2021-29388

A stored cross-site scripting XSS vulnerability in SourceCodester Budget Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php via vulnerable field 'Budget Title'...

PT-2021-18194

Name of the Vulnerable Software and Affected Versions: SourceCodester Budget Management System version 1.0 Description: A stored cross-site scripting issue allows users to inject and store arbitrary JavaScript code in index.php via the vulnerable field Budget Title. Recommendations: For...

CVE-2021-29388: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in SourceCodester Budget Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php via vulnerable field 'Budget Title'...

CVE-2020-17563: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to " /index.php?s=/admin-tpl-del&id="...

CVE-2020-35313

A server-side request forgery SSRF vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin installer...

CVE-2020-35313: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin installer...

CVE-2020-35314: Improper Neutralization of Special Elements used in an OS Command

A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to upload a custom plugin which can contain arbitrary code and obtain a webshell via the theme/plugin installer...

PT-2021-11750

Name of the Vulnerable Software and Affected Versions: WonderCMS version 3.1.3 Description: A remote code execution issue exists in the installUpdateThemePluginAction function in index.php, allowing remote attackers to upload a custom plugin containing arbitrary code and obtain a webshell via the...

CVE-2020-19778

Incorrect Access Control in Shopxo v1.4.0 and v1.5.0 allows remote attackers to gain privileges in "/index.php" by manipulating the parameter "userid" in the HTML request...

CVE-2020-21088

Cross Site Scripting XSS in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "First Name" and "Last Name" fields in "/index.php/contacts/create page"...

PT-2021-10586

Name of the Vulnerable Software and Affected Versions: X2engine X2CRM versions prior to 7.1 Description: The issue allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the First Name and Last Name fields in the "/index.php/contacts/create" page. Th...

CVE-2020-21590

Directory traversal in coreframe/app/template/admin/index.php in WUZHI CMS 4.1.0 allows attackers to list files in arbitrary directories via the dir parameter...

CVE-2020-21590: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal in coreframe/app/template/admin/index.php in WUZHI CMS 4.1.0 allows attackers to list files in arbitrary directories via the dir parameter...