PT-2018-15145

Name of the Vulnerable Software and Affected Versions PbootCMS version 1.2.1 Description The issue is related to SQL injection in the SearchController.php file of PbootCMS. This occurs via the query string in the index.php/Search/index.html endpoint. Recommendations For PbootCMS version 1.2.1,...

CVE-2018-19893: Improper Neutralization of Special Elements used in an SQL Command

SearchController.php in PbootCMS 1.2.1 has SQL injection via the index.php/Search/index.html query string...

HasanMWB 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: HasanMWB 1.0 - SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://sourceforge.net/projects/hasanmwb/ Software Link: https://netcologne.dl.sourceforge.net/project/hasanmwb/HasanMWB-v1.zip Version: 1.0 Category:...

CVE-2018-19785

PHP-Proxy (up to version 5.1.0) is affected by Cross-Site Scripting via the URL field in index.php. The root cause is insufficient sanitization of the URL parameter. Documented affected component: PHP-Proxy-app/script index.php; impact: XSS. No explicit remediation or patch details are provided i...

CVE-2018-19785: Improper Neutralization of Input During Web Page Generation

PHP-Proxy through 5.1.0 has Cross-Site Scripting XSS via the URL field in index.php...

CVE-2018-19785

PHP-Proxy through 5.1.0 has Cross-Site Scripting XSS via the URL field in index.php...

PT-2018-3688

Name of the Vulnerable Software and Affected Versions PHP-Proxy versions prior to 5.1.0 PHP-Proxy-App versions prior to 3.0 Description The issue is related to insufficient protection of the web page structure in the index.php component of the PHP-Proxy web proxy script, allowing a remote attacke...

PT-2018-15023

Name of the Vulnerable Software and Affected Versions ShowDoc version 2.4.2 Description The issue allows for a CSRF attack, which can be used to add members to a team. The affected endpoint is "server/index.php?s=/api/teamMember/save". This can potentially lead to unauthorized modifications to te...

CVE-2018-19621: Cross-Site Request Forgery (CSRF)

server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team...

Code injection

PbootCMS V1.3.1 build 2018-11-14 allows remote attackers to execute arbitrary code via use of "eval" with mixed case, as demonstrated by an index.php/list/5/?current=pboot:ifevAl$GETa1/pboot:if&a=phpinfo; URI, because of an incorrect apps\home\controller\ParserController.php parserIfLabel...

CVE-2018-19595

PbootCMS V1.3.1 build 2018-11-14 is vulnerable to remote code execution via an eval-based input in the web layer. The issue stems from an insufficient protection mechanism in apps/home/controller/ParserController.php (parserIfLabel), which allows an attacker to inject and execute code through a c...

CVE-2018-19560

BageCMS 3.1.3 has CSRF via upload/index.php?r=admini/admin/ownerUpdate to modify a user account...

CVE-2018-19548

index.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginFormusername and LoginFormpassword parameters, which might make it easier for remote attackers to obtain access via a brute-force approach...

CVE-2018-19560

CVE-2018-19560 affects BageCMS 3.1.3. The vulnerability is a Cross‑Site Request Forgery (CSRF) where an attacker can trigger actions via the endpoint upload/index.php?r=admini/admin/ownerUpdate to modify a user account. Several connected sources (NVD, Red Hat, CVE registries, CNVD) corroborate th...

PT-2018-14993

Name of the Vulnerable Software and Affected Versions EduSec versions through 4.2.6 Description The issue allows remote attackers to potentially obtain access via a brute-force approach due to the lack of restriction on sending a series of LoginFormusername and LoginFormpassword parameters to the...

PT-2018-15005

Name of the Vulnerable Software and Affected Versions BageCMS version 3.1.3 Description The issue allows for CSRF, enabling modification of a user account through the upload/index.php?r=admini/admin/ownerUpdate API endpoint. Recommendations For BageCMS version 3.1.3, update to a newer version tha...

CVE-2018-19556: Improper Input Validation

zbsystem/admin/index.php?act=UploadMng in Z-BlogPHP 1.5 mishandles file preview, leading to content spoofing. NOTE: the software maintainer disputes that this is a vulnerability...

CVE-2018-19548: Improper Restriction of Excessive Authentication Attempts

index.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginFormusername and LoginFormpassword parameters, which might make it easier for remote attackers to obtain access via a brute-force approach...

PT-2018-14970

Name of the Vulnerable Software and Affected Versions HuCart version 5.7.4 Description The issue concerns a SQL injection in the get ip function located in system/class/helper class.php. This occurs via the X-Forwarded-For HTTP header when accessing the "user/index.php?load=login&act=act login"...

CVE-2018-19468: Improper Neutralization of Special Elements used in an SQL Command

HuCart 5.7.4 has SQL injection in getip in system/class/helperclass.php via the X-Forwarded-For HTTP header to the user/index.php?load=login&act=actlogin URI...