CVE-2018-16626: Improper Neutralization of Input During Web Page Generation

index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name...

PT-2019-9360

Name of the Vulnerable Software and Affected Versions Typesetter version 5.1 Description The issue allows for XSS via an SVG file with JavaScript in a SCRIPT element, specifically in the index.php/Admin/Uploaded component. Recommendations For version 5.1, consider restricting access to the...

CVE-2018-16639: Improper Neutralization of Input During Web Page Generation

Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation...

PT-2019-9361

Name of the Vulnerable Software and Affected Versions Typesetter version 5.1 Description The issue allows for XSS via the description of a new class name in the index.php/Admin/Classes endpoint. Recommendations For version 5.1, update to a newer version that contains a fix for this issue, or as a...

PT-2019-9362

Name of the Vulnerable Software and Affected Versions Typesetter version 5.1 Description The issue allows for XSS via the LABEL parameter in the "index.php/Admin" endpoint during new page creation. Recommendations For version 5.1, avoid using the LABEL parameter in the "index.php/Admin" endpoint...

Cross site request forgery (csrf)

Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state...

CVE-2017-12790

Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state...

CVE-2017-12790

Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state...

CVE-2017-12790

CVE-2017-12790 : MetInfo 5.3.18 is affected by Cross Site Request Forgery (CSRF) affecting the admin/index.php component. The attack vector involves an administrator clicking a malicious link while logged in. Reported impact is Information Disclosure (remote). The Red Hat, NVD, PRION, and CVE cat...

CVE-2017-12788

CVE-2017-12788 affects MetInfo CMS (version 5.3.18) via admin/index.php . Vulnerable parameters are class1 and anyid , enabling multiple XSS by remote attackers to inject script/HTML. The documents do not provide exploitable details beyond the parameter vectors or any available remediation. No ex...

PT-2019-7915

Name of the Vulnerable Software and Affected Versions Metinfo version 5.3.18 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via the class1 parameter or t...

PT-2019-10268

Name of the Vulnerable Software and Affected Versions: Typesetter version 5.1 Description: The issue concerns an XSS vulnerability in the include/admin/Menu/Ajax.php file. Specifically, it affects the "index.php/Admin/Menu/Ajax?cmd=AddHidden" endpoint, where the title parameter is vulnerable to X...

PT-2019-7917

Name of the Vulnerable Software and Affected Versions Metinfo version 5.3.18 Description The issue allows for Information Disclosure through a remote attack vector. It involves a Cross Site Request Forgery CSRF attack, where the administrator clicks on a malicious link while in a logged-in state...

CVE-2018-20837: Improper Neutralization of Input During Web Page Generation

include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS...

CVE-2017-12790: Cross-Site Request Forgery (CSRF)

Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state...

CVE-2017-12788: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HTML via the 1 class1 parameter or the 2 anyid parameter...

CVE-2019-11398

Multiple cross-site scripting XSS vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon...

CVE-2019-11398: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon...

PT-2019-12383

Name of the Vulnerable Software and Affected Versions HumHub version 1.3.12 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a "POST request to /protected/vendor/codeception/codeception/tests/data/app/view/index.php". Recommendations...

PT-2019-12283

Name of the Vulnerable Software and Affected Versions UliCMS versions 2019.1 through 2019.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, o...