CVE-2019-9626: Improper Neutralization of Special Elements used in an SQL Command

PHPSHE 1.7 allows module/index/cart.php pintuanid SQL Injection to index.php...

PT-2019-19038

Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A Stored XSS issue was found in the first textbox of "System setting-site setting" in admin/index.php, specifically affecting the site name variable. Recommendations For DiliCMS version 2.4.0, as a temporary...

CVE-2019-8440: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox aka site logo of "System setting-site setting" of admin/index.php, aka sitelogo...

CVE-2019-8437: Cross-Site Request Forgery (CSRF)

njiandan-cms through 2013-05-23 has index.php/admin/usernew CSRF to add an administrator...

CVE-2019-7660: Improper Neutralization of Input During Web Page Generation

An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site Scripting XSS vulnerability, as demonstrated by admin/login.php...

CVE-2018-17426: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI...

PT-2019-18686

Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description A stored Cross-site Scripting XSS issue was found. The username parameter of the "/install/index.php" page is vulnerable. This can be demonstrated via the "admin/login.php" page. Recommendations For PHPMyWind...

PT-2019-9477

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue is related to stored XSS, which can be triggered via the Extension module and specifically the SMS in station field. This field is accessible under the index.php?m=core URI, which is an API endpoin...

PT-2019-19039

Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A Stored XSS issue was found in the second textbox of "System setting-site setting" in admin/index.php, specifically related to the site domain. Recommendations For DiliCMS version 2.4.0, at the moment, there ...

CVE-2018-17425: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI...

CVE-2019-8438: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the first textbox of "System setting-site setting" of admin/index.php, aka sitename...

CVE-2019-9226: Improper Neutralization of Input During Web Page Generation

An issue was discovered in baigo CMS 2.1.1. There is a persistent XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the optbaseBGSITENAME parameter to the bgconsole/index.php?m=opt&c=request URI...

PT-2019-19449

Name of the Vulnerable Software and Affected Versions baigo CMS version 2.1.1 Description A persistent XSS issue allows remote attackers to inject arbitrary web script or HTML via the optbaseBG SITE NAME parameter to the "bg console/index.php?m=opt&c=request" URI. Recommendations For baigo CMS...

Cross site scripting

XSS exists in WUZHI CMS 4.1.0 via index.php?m=core&f=map&v=baidumap&x=XSS&y=XSS to coreframe/app/core/map.php...

CVE-2019-9110

XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&setiframe=XSS to coreframe/app/content/postinfo.php...

PT-2019-19361

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A security issue exists where an XSS attack can be performed. The issue is related to the "index.php?m=attachment&f=imagecut&v=init&imgurl=" endpoint, which is connected to the...

CVE-2019-9107: Improper Neutralization of Input During Web Page Generation

XSS exists in WUZHI CMS 4.1.0 via index.php?m=attachment&f=imagecut&v=init&imgurl=XSS to coreframe/app/attachment/imagecut.php...

CVE-2019-9109: Improper Neutralization of Input During Web Page Generation

XSS exists in WUZHI CMS 4.1.0 via index.php?m=message&f=message&v=add&username=XSS to coreframe/app/message/message.php...

PT-2019-19364

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A security issue exists where an XSS attack can be performed. The issue is related to the "index.php?m=content&f=postinfo&v=listing&set iframe=" API endpoint, which is connected to the...

CVE-2019-9110: Improper Neutralization of Input During Web Page Generation

XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&setiframe=XSS to coreframe/app/content/postinfo.php...