13415 matches found
CVE-2019-9915
GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...
CVE-2019-9915
GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...
CVE-2019-9915
GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...
CVE-2019-9915
GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...
CVE-2019-9915
GetSimple CMS 3.3.13 contains an Open Redirect vulnerability exposed via the admin/index.php redirect parameter. An attacker can cause victims to be redirected to a malicious site, with potential for phishing or unauthorized operations depending on the redirected context. The issue is documented ...
PT-2019-19933
Name of the Vulnerable Software and Affected Versions GetSimpleCMS version 3.3.13 Description The issue is related to an Open Redirect via the redirect parameter in the admin/index.php endpoint. Recommendations For GetSimpleCMS version 3.3.13, consider restricting access to the admin/index.php...
CVE-2019-9915: URL Redirection to Untrusted Site
GetSimpleCMS 3.3.13 has an Open Redirect via the admin/index.php redirect parameter...
CVE-2018-18845: Improper Neutralization of Input During Web Page Generation
internal/advancedcommentsystem/index.php and internal/advancedcommentsystem/admin.php in Advanced Comment System, version 1.0, contain a reflected cross-site scripting vulnerability via ACSpath. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTM...
PT-2019-9631
Name of the Vulnerable Software and Affected Versions Attendance Monitoring System version 1.0 Description The issue concerns a SQL Injection flaw. It affects the id parameter in several API endpoints: "student/index.php?view=view", "event/index.php?view=view", and "user/index.php?view=view"...
CVE-2018-18798: Improper Neutralization of Special Elements used in an SQL Command
Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.php?view=view, and user/index.php?view=view...
PT-2019-18473
Name of the Vulnerable Software and Affected Versions InvoicePlane version 1.5 Description The issue is related to stored XSS via the invoice password parameter, also known as the "PDF password" field, in the "Create Invoice" option. The XSS payload is rendered at an "index.php/invoices/view/" UR...
CVE-2019-7223: Improper Neutralization of Input During Web Page Generation
InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoicepassword parameter, aka the "PDF password" field to the "Create Invoice" option. The XSS payload is rendered at an index.php/invoices/view/ URI. NOTE: this is different from CVE-2018-12255...
CVE-2019-9769
PilusCart 1.4.1 is vulnerable to index.php?module=users&action=newUser CSRF, leading to the addition of a new user as administrator...
PT-2019-19860
Name of the Vulnerable Software and Affected Versions PilusCart version 1.4.1 Description The issue allows for a CSRF attack via the "index.php?module=users&action=newUser" endpoint, potentially leading to the addition of a new user with administrator privileges. Recommendations For PilusCart...
PT-2019-19877
Name of the Vulnerable Software and Affected Versions FeiFeiCMS version 4.1.190209 Description The issue allows remote attackers to upload and execute arbitrary PHP code. This can be achieved by modifying the set of allowable file extensions through the "Admin-Index" page at the...
CVE-2019-9825: Unrestricted Upload of File with Dangerous Type
FeiFeiCMS 4.1.190209 allows remote attackers to upload and execute arbitrary PHP code by visiting index.php?s=Admin-Index to modify the set of allowable file extensions, as demonstrated by adding php to the default jpg,gif,png,jpeg setting, and then using the "add article" feature...
CVE-2019-9688
sftnow through 2018-12-29 allows index.php?g=Admin&m=User&a=addpost CSRF to add an admin account...
PT-2019-19798
Name of the Vulnerable Software and Affected Versions sftnow versions prior to 2018-12-29 Description The issue allows for a CSRF attack via the "index.php?g=Admin&m=User&a=add post" endpoint to add an admin account. Recommendations For versions prior to 2018-12-29, update to a version released...