CVE-2018-20599: Improper Control of Generation of Code

UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadminfileedit action...

CVE-2018-20601: Improper Neutralization of Input During Web Page Generation

UCMS 1.4.7 has XSS via the description parameter in an index.php listeditpost action...

CVE-2018-20612: Cross-Site Request Forgery (CSRF)

UWA 2.3.11 allows index.php?g=admin&c=admin&a=addadmindo CSRF...

CVE-2018-20572

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893...

CVE-2018-20568

Administrator/index.php in Ivan Cordoba Generic Content Management System CMS through 2018-04-28 allows SQL injection for authentication bypass...

CVE-2018-20572

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893...

CVE-2018-20572

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893...

CVE-2018-20572

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893...

CVE-2018-20569

The CVE-2018-20569 entry applies to the Ivan Cordoba Generic Content Management System (CMS) and concerns a SQL injection vulnerability in the file user/index.php up to 2018-04-28. The root cause is improper input handling in the authentication logic, enabling a bypass of authentication. If explo...

PT-2018-9482

Name of the Vulnerable Software and Affected Versions Battelle V2I Hub version 2.5.1 Description The issue is caused by improper validation of user-supplied input, allowing for cross-site scripting. A remote attacker could exploit this by using the parameterName or login username parameter in a...

PT-2018-15439

Name of the Vulnerable Software and Affected Versions Ivan Cordoba Generic Content Management System CMS versions through 2018-04-28 Description The issue allows for SQL injection, which can be used for authentication bypass. This means an attacker could potentially gain unauthorized access to th...

PT-2018-15437

Name of the Vulnerable Software and Affected Versions DouPHP version 1.5 20181221 Description An issue was discovered in DouCo DouPHP, where the /install/index.php endpoint allows a reload of the product under certain circumstances when the install.lock file cannot be read. Recommendations For...

PT-2018-15442

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue allows SQL injection via the keywords parameter in the "index.php?m=promote&f=index&v=search" endpoint. Recommendations For WUZHI CMS version 4.1.0, avoid using the keywords parameter in the affect...

CVE-2018-20569: Improper Neutralization of Special Elements used in an SQL Command

user/index.php in Ivan Cordoba Generic Content Management System CMS through 2018-04-28 allows SQL injection for authentication bypass...

CVE-2018-20568: Improper Neutralization of Special Elements used in an SQL Command

Administrator/index.php in Ivan Cordoba Generic Content Management System CMS through 2018-04-28 allows SQL injection for authentication bypass...

CVE-2018-20567: Incorrect Permission Assignment for Critical Resource

An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic circumstances in which install.lock cannot be read...

CVE-2018-1000629: Improper Neutralization of Input During Web Page Generation

Battelle V2I Hub 2.5.1 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by api/SystemConfigActions.php?action=add and the index.php script. A remote attacker could exploit this vulnerability using the parameterName or loginusername parameter in a...

CVE-2018-20572: Improper Neutralization of Special Elements used in an SQL Command

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893...

PT-2018-15411

Name of the Vulnerable Software and Affected Versions 74cms version 4.2.111 Description An issue in 74cms allows remote authenticated users to read or modify arbitrary resumes. This is achieved by changing a job-search intention, specifically through the "index.php?c=Personal&a=ajax save basic"...

CVE-2018-20519: Improper Input Validation

An issue was discovered in 74cms v4.2.111. It allows remote authenticated users to read or modify arbitrary resumes by changing a job-search intention, as demonstrated by the index.php?c=Personal&a=ajaxsavebasic pid parameter...