13411 matches found
CVE-2019-16312
s-cms V3.0 has XSS in index.php?type=text via the Sid parameter...
Design/Logic Flaw
s-cms V3.0 has XSS in index.php?type=text via the Sid parameter...
Design/Logic Flaw
NIUSHOP V1.11 has XSS via the index.php?s=/admin URI...
Cross site request forgery (csrf)
NIUSHOP V1.11 has CSRF via searchinfo to index.php...
CVE-2019-16310
CVE-2019-16310 affects NIUSHOP V1.11 with an XSS vulnerability via the index.php?s=/admin URI. The connected records do not provide payloads, affected sub-versions beyond V1.11, remediation steps, or explicit exploit details. CVSS metrics are provided (NVD CVSSv2 base 3.5, CVSSv3.1 base 5.4). Act...
CVE-2019-16310
NIUSHOP V1.11 has XSS via the index.php?s=/admin URI...
CVE-2019-16311
NIUSHOP V1.11 has CSRF via searchinfo to index.php...
CVE-2019-16311
CVE-2019-16311 : NIUSHOP V1.11 has a CSRF vulnerability via search_info to index.php. The connected sources cite a high-severity issue (CVSSv3.1 base score 8.8) with network access and required user interaction, but no exploitation details are provided in the documents.
CVE-2019-16312
CVE-2019-16312 affects s-cms v3.0 with a stored/reflected XSS in index.php?type=text via the S_id parameter. The Red Hat and NVD entries confirm the same description; public details are limited to the XSS path and parameter, with no explicit exploitation vectors or patched versions provided in th...
CVE-2019-16310: Improper Neutralization of Input During Web Page Generation
NIUSHOP V1.11 has XSS via the index.php?s=/admin URI...
PT-2019-14619
Name of the Vulnerable Software and Affected Versions NIUSHOP version 1.11 Description The issue is related to a security problem where an attacker can inject malicious code. The problem occurs via the "index.php?s=/admin" API endpoint. Recommendations For NIUSHOP version 1.11, update to a versio...
PT-2019-14621
Name of the Vulnerable Software and Affected Versions s-cms version V3.0 Description The issue is related to a security problem where an attacker can inject malicious code. The problem occurs in the index.php file when the type parameter is set to 'text' and the S id parameter is manipulated...
CVE-2019-16312: Improper Neutralization of Input During Web Page Generation
s-cms V3.0 has XSS in index.php?type=text via the Sid parameter...
CVE-2019-16311: Cross-Site Request Forgery (CSRF)
NIUSHOP V1.11 has CSRF via searchinfo to index.php...
PT-2019-14620
Name of the Vulnerable Software and Affected Versions NIUSHOP version 1.11 Description The issue allows for CSRF via the search info parameter to the "/index.php" API endpoint. Recommendations For NIUSHOP version 1.11, consider implementing CSRF protection mechanisms, such as token-based...
PT-2019-14497
Name of the Vulnerable Software and Affected Versions Sentrifugo version 3.2 Description The issue lacks CSRF protection, which could allow an attacker to trick the administrator into executing arbitrary code. This can be achieved by accessing the "index.php/dashboard/viewprofile" API endpoint vi...
CVE-2019-16059: Cross-Site Request Forgery (CSRF)
Sentrifugo 3.2 lacks CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code at index.php/dashboard/viewprofile via a crafted HTML page...
CVE-2019-10687
KBPublisher 6.0.2.1 contains SQL injection vulnerabilities in multiple entry points: admin/index.php?module=report&entry_id[0] and admin/index.php?module=log&id, as well as index.php?View=print&id[] (and related POST parameters). Some sources note the issue affects both admin and public (unauthen...
PT-2019-11993
Name of the Vulnerable Software and Affected Versions KBPublisher version 6.0.2.1 Description The issue concerns SQL Injection, which can be exploited through specific parameters in the application. The vulnerable parameters include entry id0 in the "admin/index.php?module=report" endpoint, id in...
CVE-2019-10687: Improper Neutralization of Special Elements used in an SQL Command
KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entryid0 parameter, the admin/index.php?module=log id parameter, or an index.php?View=print&id= request...