PT-2018-15404

Name of the Vulnerable Software and Affected Versions S-CMS version 1.0 Description The issue allows SQL Injection via the "wap index.php?type=newsinfo" API endpoint, specifically through the S id parameter. Recommendations For S-CMS version 1.0, avoid using the S id parameter in the "wap...

PT-2018-15389

Name of the Vulnerable Software and Affected Versions 74cms version 4.2.111 Description A security issue was found in the software, where the "upload/index.php?c=resume&a=resume list" endpoint is vulnerable to XSS attacks via the key parameter. Recommendations For version 4.2.111, as a temporary...

PT-2018-15384

Name of the Vulnerable Software and Affected Versions Frog CMS version 0.9.5 Description The issue allows for XSS via the Database name field to the "/install/index.php" API endpoint. Recommendations For Frog CMS version 0.9.5, update to a version that fixes this issue, as using the Database name...

CVE-2018-20454: Improper Neutralization of Input During Web Page Generation

An issue was discovered in 74cms v4.2.111. upload/index.php?c=resume&a=resumelist has XSS via the key parameter...

CVE-2018-20448: Improper Neutralization of Input During Web Page Generation

Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI...

CVE-2018-20418

index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab...

PT-2018-15362

Name of the Vulnerable Software and Affected Versions Craft CMS version 3.0.25 Description The issue allows for cross-site scripting XSS by saving a new title from the console tab, specifically through the "index.php?p=admin/actions/entries/save-entry" endpoint. Recommendations For Craft CMS...

CVE-2018-20418: Improper Neutralization of Input During Web Page Generation

index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab...

CVE-2018-20367: Improper Neutralization of Input During Web Page Generation

The "mall some commodity details: commodity consultation" component in WSTMart 2.0.8181212 has stored XSS via the consultContent parameter, as demonstrated by the index.php/home/goodsconsult/add.html URI...

CVE-2018-1000848

Wampserver version prior to version 3.1.5 contains a Cross Site Scripting XSS vulnerability in index.php localhost page that can result in very low. This attack appear to be exploitable via payload onmouseover. This vulnerability appears to have been fixed in 3.1.5 and later...

CVE-2018-1000848

Wampserver version prior to version 3.1.5 contains a Cross Site Scripting XSS vulnerability in index.php localhost page that can result in very low. This attack appear to be exploitable via payload onmouseover. This vulnerability appears to have been fixed in 3.1.5 and later...

Cross site scripting

Wampserver version prior to version 3.1.5 contains a Cross Site Scripting XSS vulnerability in index.php localhost page that can result in very low. This attack appear to be exploitable via payload onmouseover. This vulnerability appears to have been fixed in 3.1.5 and later...

CVE-2018-1000846

FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery CSRF vulnerability in All authenticated API calls in index.php / class.manager.php that can result in Editing domains and zones with victim's privileges. This attack appear to be exploitable via Victim must open a website...

CVE-2018-1000846

FreshDNS

CVE-2018-1000848

CVE-2018-1000848 refers to a Cross Site Scripting (XSS) vulnerability in WampServer when using versions prior to 3.1.5. The issue affects the local index.php page and can be triggered by a payload via an onmouseover event, enabling potential script execution in a victim’s browser. The vulnerabili...

PT-2018-9570

Name of the Vulnerable Software and Affected Versions FreshDNS versions 1.0.3 and earlier Description The issue concerns a Cross-Site Request Forgery CSRF vulnerability that affects all authenticated API calls in index.php and class.manager.php. This can lead to the editing of domains and zones...

PT-2018-9572

Name of the Vulnerable Software and Affected Versions Wampserver versions prior to 3.1.5 Description The issue is related to a Cross Site Scripting XSS vulnerability in the index.php localhost page. This can be exploited via a payload using the onmouseover event, which can result in low impact. T...

CVE-2018-1000846: Cross-Site Request Forgery (CSRF)

FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery CSRF vulnerability in All authenticated API calls in index.php / class.manager.php that can result in Editing domains and zones with victim's privileges. This attack appear to be exploitable via Victim must open a website...

CVE-2018-1000884: Observable Discrepancy

Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 contains a CWE-208 / Information Exposure Through Timing Discrepancy vulnerability in Password reset code -- web/reset/index.php, line 51 that can result in Possible to determine password...

CVE-2018-1000848: Improper Neutralization of Input During Web Page Generation

Wampserver version prior to version 3.1.5 contains a Cross Site Scripting XSS vulnerability in index.php localhost page that can result in very low. This attack appear to be exploitable via payload onmouseover. This vulnerability appears to have been fixed in 3.1.5 and later...