PT-2019-7403

Name of the Vulnerable Software and Affected Versions altos-connect plugin version 1.3.0 Description The issue concerns a cross-site scripting XSS problem. It affects the wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php "PATH SELF" in the altos-connect plugin...

CVE-2019-16867

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. If the attacker deletes config.php and visits install/index.php, they can reinstall the product...

CVE-2019-16867

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. If the attacker deletes config.php and visits install/index.php, they can reinstall the product...

CVE-2019-16867

HongCMS 3.0.0 is affected by a path-traversal vulnerability allowing arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete (and similar CVE-2018-16774 path). Root cause is insufficient validation of the file path, enabling deletion of critical file...

CVE-2019-16867: Improper Limitation of a Pathname to a Restricted Directory

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. If the attacker deletes config.php and visits install/index.php, they can reinstall the product...

PT-2019-14838

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue allows for arbitrary file deletion by utilizing a ../ in the file parameter to the "admin/index.php/database/ajax" endpoint with the action set to delete. This can be exploited to delete critical fil...

PT-2019-14791

Name of the Vulnerable Software and Affected Versions WTCMS version 1.0 Description The issue allows for a CSRF attack with resultant XSS via the index.php endpoint, specifically when accessing the g=admin&m=index&a=index parameters. This can lead to unauthorized actions being performed on the...

CVE-2019-16719: Improper Neutralization of Input During Web Page Generation

WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS...

PT-2019-14793

Name of the Vulnerable Software and Affected Versions NoneCMS version 1.3 Description The issue concerns a CSRF flaw in the public/index.php/admin/admin/dele.html endpoint, which can be exploited to delete the admin user. Recommendations For NoneCMS version 1.3, as a temporary workaround, conside...

CVE-2019-16721: Cross-Site Request Forgery (CSRF)

NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user...

CVE-2019-16664

An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter...

CVE-2019-16659

TuziCMS 2.0.6 has index.php/manage/link/doadd CSRF...

Cross site request forgery (csrf)

TuziCMS 2.0.6 has index.php/manage/link/doadd CSRF...

Design/Logic Flaw

An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element...

Cross site request forgery (csrf)

TuziCMS 2.0.6 has index.php/manage/notice/doadd CSRF...

Design/Logic Flaw

An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter...

CVE-2019-16664

ThinkSAAS 2.91 is affected by CVE-2019-16664: an XSS via the parameter groupname in index.php?app=group&ac=create&ts=do. Root cause described across sources is insufficient sanitization of the groupname input, enabling cross-site scripting. Affected product/version: ThinkSAAS 2.91. The Red Hat ad...

CVE-2019-16658

TuziCMS 2.0.6 is affected by a CSRF vulnerability in the endpoint index.php/manage/notice/do_add . The provided documents identify the root cause as a CSRF issue at that endpoint. No exploitation specifics or remediation steps are given in the sources. If present, check for interim mitigations; o...

CVE-2019-16659

The connected sources confirm CVE-2019-16659 affects TuziCMS 2.0.6, describing a CSRF issue in index.php/manage/link/do_add. The root cause is a Cross-Site Request Forgery vulnerability in that endpoint, enabling unauthorized state-changing requests from a logged-in user. Exploit details, affecte...

CVE-2019-16664: Improper Neutralization of Input During Web Page Generation

An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter...