PT-2019-13498

Name of the Vulnerable Software and Affected Versions Metinfo versions 6.x Description The issue allows SQL Injection via the id parameter in an "admin/index.php?n=ui set&m=admin&c=index&a=doget text content&table=lang&field=1" request. Recommendations For Metinfo version 6.x, consider restrictin...

Cross site scripting

index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment...

CVE-2019-13949: Cross-Site Request Forgery (CSRF)

SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change...

PT-2019-13489

Name of the Vulnerable Software and Affected Versions SyGuestBook A5 version 1.2 Description The issue is related to stored XSS that can be triggered via a reply to a comment. The specific endpoint involved is "index.php?c=admin&a=index". This allows for potential malicious script execution when ...

CVE-2019-13950: Improper Neutralization of Input During Web Page Generation

index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment...

PT-2019-13488

Name of the Vulnerable Software and Affected Versions SyGuestBook A5 version 1.2 Description The issue concerns the lack of a CSRF protection mechanism. This is demonstrated through a CSRF attack on the index.php?c=Administrator&a=update endpoint, which allows for an admin password change...

CVE-2019-1010028

phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/sendreply/. The attack vector is:...

PT-2019-11442

Name of the Vulnerable Software and Affected Versions: phpscriptsmall.com School College Portal with ERP Script versions 2.6.1 and earlier Description: The issue allows attackers to target administrators, teachers, and students. It involves a Cross Site Scripting XSS attack, which can be executed...

CVE-2019-13396

FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the forminclude parameter in an index.php?q=system-handle-form-submit POST request because of an includeonce in systemhandleformsubmit in modules/system/system.module...

CVE-2019-13396: Improper Limitation of a Pathname to a Restricted Directory

FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the forminclude parameter in an index.php?q=system-handle-form-submit POST request because of an includeonce in systemhandleformsubmit in modules/system/system.module...

CVE-2019-13472

PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file...

Cross site scripting

PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file...

CVE-2019-13472

PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file...

CVE-2019-13472

CVE-2019-13472 affects PHPWind 9.1.0. The vulnerability is an XSS issue in the index.php file, specifically in the c and m parameters. The connected documents confirm these are cross-site scripting vulnerabilities but do not provide exploitation details, affected versions beyond 9.1.0, or remedia...

CVE-2019-13472: Improper Neutralization of Input During Web Page Generation

PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file...

PT-2019-13354

Name of the Vulnerable Software and Affected Versions PHPWind version 9.1.0 Description The issue concerns a security problem where an attacker can inject malicious scripts into the c and m parameters of the index.php file, potentially leading to unauthorized actions on the affected system...

CVE-2019-13370

index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator...

PT-2019-5804

Name of the Vulnerable Software and Affected Versions D-Link Central WiFi Manager CWM100 versions prior to v1.03R0100 BETA6 Description A cross-site scripting XSS issue in the PayAction.class.php resource view allows remote attackers to inject arbitrary web script or HTML via the passcode paramet...

CVE-2019-13370: Cross-Site Request Forgery (CSRF)

index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator...

CVE-2019-13374: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM100 before v1.03R0100BETA6 allows remote attackers to inject arbitrary web script or HTML via the index.php/Pay/passcodeAuth passcode parameter...