13416 matches found
PT-2019-9874
Name of the Vulnerable Software and Affected Versions Rhymix CMS version 1.9.8.1 Description The issue allows for Server-Side Request Forgery SSRF via an SVG upload in the admin module. This can be achieved by accessing the "index.php?module=admin&act=dispModuleAdminFileBox" endpoint with a...
CVE-2018-14481: Improper Neutralization of Input During Web Page Generation
Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...
CVE-2018-19600: Improper Neutralization of Input During Web Page Generation
Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...
PT-2019-10011
Name of the Vulnerable Software and Affected Versions: Rukovoditel version 2.3.1 Description: A file-upload issue exists, allowing users to upload PHP content by exploiting a weakness in extension checking. The "index.php?module=configuration/save" endpoint accepts uploads if the first few...
CVE-2018-20166: Unrestricted Upload of File with Dangerous Type
A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, and mishandles extension checking. It accepts uploads of PHP content if the first few characters match GIF data, and the filename ends in ".php" with mixed...
Design/Logic Flaw
UCMS 1.4.7 has XSS via the dir parameter in an index.php sadminfileedit action...
Design/Logic Flaw
UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadminfileedit action...
Design/Logic Flaw
UCMS 1.4.7 has XSS via the description parameter in an index.php listeditpost action...
CVE-2018-20597
UCMS 1.4.7 has XSS via the dir parameter in an index.php sadminfileedit action...
CVE-2018-20601
UCMS 1.4.7 has XSS via the description parameter in an index.php listeditpost action...
CVE-2018-20601
UCMS 1.4.7 is affected by a Cross‑Site Scripting (XSS) flaw in the description parameter used by the index.php list_editpost action. The root cause, as described across sources, is unescaped or insufficiently sanitized input in the description field that can be reflected in the rendered page. Thi...
CVE-2018-20600
CVE-2018-20600 affects UCMS 1.4.7 where sadmin\cedit.php is vulnerable to cross-site scripting via the index.php sadmin_cedit action. The vulnerability allows injection of arbitrary web script or HTML, with the CVSS 3.0/2.0 metrics indicating network access, no authentication, user interaction re...
CVE-2018-20599
CVE-2018-20599 affects UCMS 1.4.7, where input during the index.php sadmin_fileedit action can be used to execute arbitrary PHP code, enabling remote code execution. The issue is described across multiple sources (NVD/Red Hat/NVD mirror), confirming that the vulnerability stems from the sadmin_fi...
CVE-2018-20597
UCMS 1.4.7 is affected by a cross-site scripting (XSS) vulnerability caused by unsafely handling the dir parameter in the sadmin_fileedit action of index.php. The issue allows injection of arbitrary HTML/JavaScript in user-visible pages. No exploits or practical in-the-wild details are provided i...
CVE-2018-20597
UCMS 1.4.7 has XSS via the dir parameter in an index.php sadminfileedit action...
PT-2018-15465
Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue allows for XSS via the description parameter in the "list editpost" action of index.php. Recommendations For version 1.4.7, avoid using the description parameter in the vulnerable index.php list editpos...
PT-2018-15464
Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue is related to a Cross-Site Scripting XSS problem. It occurs in the sadmincedit.php file of UCMS when an action is performed on index.php, specifically the sadmin cedit action. Recommendations For UCMS...
PT-2018-15476
Name of the Vulnerable Software and Affected Versions UWA version 2.3.11 Description The issue allows for a CSRF attack via the index.php?g=admin&c=admin&a=add admin do endpoint. Recommendations For version 2.3.11, consider implementing CSRF protection measures, such as token-based validation, to...
PT-2018-15463
Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by entering the code during an index.php sadmin fileedit action. Recommendations For UCMS version 1.4.7, consider restricting...