PT-2018-9570

Name of the Vulnerable Software and Affected Versions FreshDNS versions 1.0.3 and earlier Description The issue concerns a Cross-Site Request Forgery CSRF vulnerability that affects all authenticated API calls in index.php and class.manager.php. This can lead to the editing of domains and zones...

PT-2018-9572

Name of the Vulnerable Software and Affected Versions Wampserver versions prior to 3.1.5 Description The issue is related to a Cross Site Scripting XSS vulnerability in the index.php localhost page. This can be exploited via a payload using the onmouseover event, which can result in low impact. T...

CVE-2018-1000846: Cross-Site Request Forgery (CSRF)

FreshDNS version 1.0.3 and earlier contains a Cross ite Request Forgery CSRF vulnerability in All authenticated API calls in index.php / class.manager.php that can result in Editing domains and zones with victim's privileges. This attack appear to be exploitable via Victim must open a website...

CVE-2018-1000884: Observable Discrepancy

Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 contains a CWE-208 / Information Exposure Through Timing Discrepancy vulnerability in Password reset code -- web/reset/index.php, line 51 that can result in Possible to determine password...

CVE-2018-1000848: Improper Neutralization of Input During Web Page Generation

Wampserver version prior to version 3.1.5 contains a Cross Site Scripting XSS vulnerability in index.php localhost page that can result in very low. This attack appear to be exploitable via payload onmouseover. This vulnerability appears to have been fixed in 3.1.5 and later...

PT-2018-9600

Name of the Vulnerable Software and Affected Versions: Vesta CP versions prior to 0.9.8-18 Description: The issue is related to a timing discrepancy in the password reset code, located in the web/reset/index.php file, line 51. This can potentially allow an attacker to determine password reset cod...

Integria IMS 5.0.83 - search_string Cross-Site Scripting

Integria IMS 5.0.83 - searchstring Cross-Site Scripting Exploit Title: Integria IMS 5.0.83 - Cross-Site Scripting Exploit Author: Javier Olmedo Website: https://hackpuntes.com Date: 2018-12-18 Google Dork: N/A Vendor: Artica ST Software Link: https://github.com/articaST/integriaims Affected...

PT-2018-14977

Name of the Vulnerable Software and Affected Versions Zurmo version 3.2.4 Description The issue allows for XSS via an admin's use of the name parameter in the reports section. This can be exploited through the /app/index.php/reports/default/details?id=1 API endpoint. Recommendations For Zurmo...

CVE-2018-16636

Nucleus CMS 3.70 allows HTML Injection via the index.php body parameter...

Design/Logic Flaw

Nucleus CMS 3.70 allows HTML Injection via the index.php body parameter...

Input validation

PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI...

CVE-2018-20012

PHPCMF 4.1.3 is affected by an XSS vulnerability reachable through the first input field of index.php?s=member&c=register&m=index. The issue allows injection of script via the input and could impact users loading the page. No remediation details are provided in the supplied documents.

PT-2018-13663

Name of the Vulnerable Software and Affected Versions Nucleus CMS version 3.70 Description The issue allows for HTML Injection via the body parameter in index.php. Recommendations For Nucleus CMS version 3.70, avoid using the body parameter in the index.php endpoint until the issue is resolved...

PT-2018-15236

Name of the Vulnerable Software and Affected Versions PHPCMF version 4.1.3 Description The issue is related to a security problem where an attacker can inject malicious code. The problem occurs via the first input field to the "index.php?s=member&c=register&m=index" URI, allowing for malicious co...

CVE-2018-16636: Improper Neutralization of Input During Web Page Generation

Nucleus CMS 3.70 allows HTML Injection via the index.php body parameter...

CVE-2018-20012: Improper Neutralization of Input During Web Page Generation

PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI...

CVE-2018-20006: Improper Neutralization of Input During Web Page Generation

An issue was discovered in PHPok v5.0.055. There is a Stored XSS vulnerability via the title parameter to api.php?c=post&f=save reachable via the index.php?id=book URI...

Sql injection

SearchController.php in PbootCMS 1.2.1 has SQL injection via the index.php/Search/index.html query string...

CVE-2018-19893

SearchController.php in PbootCMS 1.2.1 has SQL injection via the index.php/Search/index.html query string...

PT-2018-15145

Name of the Vulnerable Software and Affected Versions PbootCMS version 1.2.1 Description The issue is related to SQL injection in the SearchController.php file of PbootCMS. This occurs via the query string in the index.php/Search/index.html endpoint. Recommendations For PbootCMS version 1.2.1,...