CVE-2019-5886

An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lock file in the Add method, which allows an attacker to reinstall the database. The attacker can write arbitrary code to database.php during system reinstallation...

PT-2019-17844

Name of the Vulnerable Software and Affected Versions ShopXO version 1.2.0 Description An issue in the application allows an attacker to reinstall the database due to the lack of validation in the Add method of the Index.php file. This enables the attacker to write arbitrary code to database.php...

CVE-2019-5886: Improper Locking

An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation lock file in the Add method, which allows an attacker to reinstall the database. The attacker can write arbitrary code to database.php during system reinstallation...

CVE-2019-5725

qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file...

PT-2019-17833

Name of the Vulnerable Software and Affected Versions qibosoft versions through V7 Description The issue allows remote attackers to read arbitrary files via the main parameter in member/index.php, which can be exploited through Server-Side Request Forgery SSRF to read sensitive files, such as .sq...

CVE-2019-5725: Server-Side Request Forgery (SSRF)

qibosoft through V7 allows remote attackers to read arbitrary files via the member/index.php main parameter, as demonstrated by SSRF to a URL on the same web site to read a .sql file...

CVE-2019-5488

EARCLINK ESPCMS-P8 has SQL injection in the installpack/index.php?ac=Member&at=verifyAccount verifykey parameter. installpack/espcmspublic/espcmsdb.php may allow retrieving sensitive information from the ESPCMS database...

PT-2019-17706

Name of the Vulnerable Software and Affected Versions EARCLINK ESPCMS-P8 Description The issue concerns a SQL injection in the install pack/index.php ac=Member&at=verifyAccount endpoint, specifically in the verify key parameter. This could potentially allow an attacker to retrieve sensitive...

CVE-2019-5488: Improper Neutralization of Special Elements used in an SQL Command

EARCLINK ESPCMS-P8 has SQL injection in the installpack/index.php?ac=Member&at=verifyAccount verifykey parameter. installpack/espcmspublic/espcmsdb.php may allow retrieving sensitive information from the ESPCMS database...

CVE-2019-5311

An issue was discovered in YUNUCMS V1.1.8. app/index/controller/Show.php has an XSS vulnerability via the index.php/index/show/index cw parameter...

CVE-2019-5311

An issue was discovered in YUNUCMS V1.1.8. app/index/controller/Show.php has an XSS vulnerability via the index.php/index/show/index cw parameter...

PT-2019-17574

Name of the Vulnerable Software and Affected Versions YUNUCMS version 1.1.8 Description An issue was discovered in YUNUCMS, where the app/index/controller/Show.php file has a cross-site scripting XSS vulnerability. This vulnerability can be exploited via the cw parameter in the...

CVE-2019-5311: Improper Neutralization of Input During Web Page Generation

An issue was discovered in YUNUCMS V1.1.8. app/index/controller/Show.php has an XSS vulnerability via the index.php/index/show/index cw parameter...

CVE-2018-19600

Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...

CVE-2018-19601

Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...

Design/Logic Flaw

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...

CVE-2018-14481

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...

CVE-2018-14481

OSClass 3.7.4 is affected by CVE-2018-14481: it has Cross-Site Scripting (XSS) via the query string to index.php (notably in the OSClass 3.7.4 release, separate from CVE-2014-6280). Other connected sources describe multiple XSS vulnerabilities in OSClass 3.7.4, including potential reflections and...

CVE-2018-14481

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...

PT-2019-9027

Name of the Vulnerable Software and Affected Versions Osclass version 3.7.4 Description The issue is related to a Cross-Site Scripting XSS vulnerability. It occurs via the query string to the "index.php" endpoint. Recommendations For Osclass version 3.7.4, update to a version that includes a fix...