CVE-2019-11451

CVE-2019-11451 affects the web app "whatsns 4.0". A SQL injection vulnerability exists in the parameterized endpoint: index.php?inform/add.html with the qid parameter. The root cause is unsanitized input leading to SQL injection, enabling an attacker to potentially read/modify data and affect ava...

CVE-2019-11450

CVE-2019-11450 affects Whatsns 4.0, where SQL injection is possible via the title parameter in index.php?question/ajaxadd.html. The issue is documented with CVSS v3.0 base score 9.8 (CRITICAL) and CVSS v2.0 base score 7.5 (HIGH). Affected component: the title field in the ajaxadd endpoint; root c...

PT-2019-12317

Name of the Vulnerable Software and Affected Versions whatsns version 4.0 Description The issue allows for SQL injection through the cid parameter in the /index.php?admin category/remove.html endpoint. Recommendations For version 4.0, avoid using the cid parameter in the /index.php?admin...

CVE-2019-11452: Improper Neutralization of Special Elements used in an SQL Command

whatsns 4.0 allows index.php?admincategory/remove.html cid SQL injection...

CVE-2019-11451: Improper Neutralization of Special Elements used in an SQL Command

whatsns 4.0 allows index.php?inform/add.html qid SQL injection...

CVE-2019-11450: Improper Neutralization of Special Elements used in an SQL Command

whatsns 4.0 allows index.php?question/ajaxadd.html title SQL injection...

CVE-2019-11447: Unrestricted Upload of File with Dangerous Type

An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatarfile field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content ...

PT-2019-12312

Name of the Vulnerable Software and Affected Versions CutePHP CuteNews version 2.1.2 Description An issue allows an attacker to infiltrate the server through the avatar upload process in the profile area via the "index.php?mod=main&opt=personal" endpoint, by exploiting the avatar file field. The...

PT-2019-12316

Name of the Vulnerable Software and Affected Versions whatsns version 4.0 Description The issue allows for SQL injection through the qid variable in the /index.php?inform/add.html endpoint. Recommendations For version 4.0, avoid using the qid variable in the /index.php?inform/add.html endpoint...

PT-2019-12315

Name of the Vulnerable Software and Affected Versions whatsns version 4.0 Description The issue allows for SQL injection through the title parameter in the index.php?question/ajaxadd.html endpoint. Recommendations For version 4.0, avoid using the title parameter in the...

Cross site request forgery (csrf)

74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI...

CVE-2019-11374

74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI...

CVE-2019-11374: Cross-Site Request Forgery (CSRF)

74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the index.php?m=Admin&c=admin&a=add URI...

PT-2019-12265

Name of the Vulnerable Software and Affected Versions 74CMS version 5.0.1 Description The issue allows an attacker to add a new admin user via the "index.php?m=Admin&c=admin&a=add" API endpoint. This is due to a CSRF vulnerability. Recommendations For version 5.0.1, update to a newer version that...

CVE-2018-19202: Improper Neutralization of Input During Web Page Generation

A reflected XSS vulnerability in index.php in MyBB 1.8.x through 1.8.19 allows remote attackers to inject JavaScript via the 'upsettingbburl' parameter...

PT-2019-9758

Name of the Vulnerable Software and Affected Versions MyBB versions 1.8.x through 1.8.19 Description A reflected XSS issue allows remote attackers to inject JavaScript via the upsettingbburl parameter in the index.php file. Recommendations For MyBB versions 1.8.x through 1.8.19, update to a versi...

PT-2019-11990

Name of the Vulnerable Software and Affected Versions 74cms version 5.0.1 Description The issue allows remote attackers to execute arbitrary PHP code. This is achieved via the site domain parameter in the /index.php?m=Admin&c=config&a=edit API endpoint. Recommendations For version 5.0.1, as a...

Rukovoditel ERP & CRM 2.4.1 - path Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Rukovoditel ERP & CRM 2.4.1 - 'path' Cross-Site Scripting Exploit Author: Javier Olmedo Website: https://hackpuntes.com Vendor: Rukovoditel Software Link: https://sourceforge.net/projects/rukovoditel/ Affected Version: 2.4.1 and...

Nextcloud: [Reflected XSS] In Request URL

In index.php file on 1765 we can see XSS: " Because NextCloud allow links like: '/index.php/ANYCONTENT' If we will do request like: POST /updater/index.php/h"alert1; HTTP/1.1 Host: vulns.local Content-Type: application/x-www-form-urlencoded Content-Length: 33 updater-secret-input=OURSECRET We wil...

Rukovoditel ERP & CRM 2.4.1 - 'path' Cross-Site Scripting

Exploit Title: Rukovoditel ERP & CRM 2.4.1 - 'path' Cross-Site Scripting Exploit Author: Javier Olmedo Website: https://hackpuntes.com Date: 2019-03-24 Google Dork: N/A Vendor: Rukovoditel Software Link: https://sourceforge.net/projects/rukovoditel/ Affected Version: 2.4.1 and possibly before...