CVE-2019-7737

Verydows v2.0 is affected by a CSRF vulnerability that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit. The issue is documented in CVE-2019-7737 with NVD metrics indicating high impact (C/H/I/A) and network attack vector, requiring no authentication. Connected sources c...

CVE-2019-7721

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

CVE-2019-7721

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

CVE-2019-7721

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

CVE-2019-7737: Cross-Site Request Forgery (CSRF)

A CSRF vulnerability was found in Verydows v2.0 that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit...

PT-2019-18731

Name of the Vulnerable Software and Affected Versions Verydows version 2.0 Description A CSRF issue was discovered that allows adding an admin account via the "index.php?m=backend&c=admin&a=add&step=submit" endpoint, specifically by manipulating the a and step variables. Recommendations For versi...

PT-2019-18723

Name of the Vulnerable Software and Affected Versions nc-cms version 3.5 Description The issue allows for the upload of .php files. This is achieved through the index.php?action=save endpoint, utilizing the name and editordata parameters. Recommendations For nc-cms version 3.5, restrict access to...

PT-2019-18720

Name of the Vulnerable Software and Affected Versions Metinfo versions 6.x Description An issue was discovered that allows an attacker to execute arbitrary PHP code via a race condition in the backend database backup function. This can be achieved by leveraging the admin/index.php and...

CVE-2019-7718: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=...

CVE-2019-7721: Unrestricted Upload of File with Dangerous Type

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

CVE-2019-7568

An issue was discovered in baijiacms V4 that can result in time-based blind SQL injection to get data via the cate parameter in an index.php?act=index request...

Sql injection

An issue was discovered in baijiacms V4 that can result in time-based blind SQL injection to get data via the cate parameter in an index.php?act=index request...

CVE-2019-7568

The CVE-2019-7568 issue affects baijiacms V4. It describes a time-based blind SQL injection in the cate parameter exposed through index.php?act=index, enabling data retrieval from the database. The NVD record lists a high/critical risk profile (CVSS v2 base 7.5, CVSS v3 base 9.8) indicating netwo...

PT-2019-18631

Name of the Vulnerable Software and Affected Versions Gurock TestRail version 5.3.0.3603 Description The issue concerns the disclosure of potentially sensitive information when an invalid request is made to index.php. This can lead to full path disclosure and the identification of PHP as the...

CVE-2019-7585: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Waimai Super Cms 20150505. web/Lib/Action/PublicAction.class.php allows time-based SQL Injection via the param array parameter to the /index.php?m=public&a=checkemail URI...

CVE-2019-7535: Exposure of Sensitive Information to an Unauthorized Actor

index.php in Gurock TestRail 5.3.0.3603 returns potentially sensitive information for an invalid request, as demonstrated by full path disclosure and the identification of PHP as the backend technology...

CVE-2019-7568: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in baijiacms V4 that can result in time-based blind SQL injection to get data via the cate parameter in an index.php?act=index request...

PT-2019-18651

Name of the Vulnerable Software and Affected Versions baijiacms version V4 Description The issue allows for time-based blind SQL injection, enabling data retrieval via the cate parameter in an "index.php?act=index" request. Recommendations For baijiacms version V4, consider restricting access to...

PT-2019-18658

Name of the Vulnerable Software and Affected Versions Waimai Super Cms version 20150505 Description An issue was discovered that allows time-based SQL Injection. The /index.php?m=public&a=checkemail URI is vulnerable via the param array parameter in the web/Lib/Action/PublicAction.class.php file...

CVE-2019-7326

Self - Stored Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Host' parameter value in the view console console.php because proper filtration is omitted. This relates to the index.php?view=monitor Host Name...