CVE-2018-19458

In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246...

PT-2018-14966

Name of the Vulnerable Software and Affected Versions PHP Proxy version 3.0.3 Description The issue allows any user to read files from the server without authentication due to a Local File Inclusion LFI vulnerability. This is achieved through the "index.php?q=file:///" URI. Recommendations For PH...

CVE-2018-19463: Improper Control of Generation of Code

zbsystem/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg content type in an upload to the zbsystem/admin/index.php?act=UploadMng URI. NOTE: The vendor's position is "We have no dynamic including. No one can run PHP b...

CVE-2018-19458: Improper Authentication

In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246...

CVE-2018-18774

CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter...

CVE-2018-18774

CVE-2018-18774 affects CentOS Web Panel (CentOS Web Panel) versions up to 0.9.8.740. The vulnerability is an XSS flaw exploitable through the admin/index.php endpoint via the module parameter, allowing an attacker to inject arbitrary web script into the administrator’s browser. Several sources in...

PT-2018-3061

Name of the Vulnerable Software and Affected Versions D-Link Central WiFi Manager CWM100 versions prior to v1.03R0100 BETA6 Description A SQL Injection issue was discovered in the PayAction.class.php file, specifically with the passcode parameter in the "index.php/Pay/passcodeAuth" endpoint. This...

CVE-2018-18773: Cross-Site Request Forgery (CSRF)

CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password...

CVE-2018-18772: Cross-Site Request Forgery (CSRF)

CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=sendssh, as demonstrated by executing an arbitrary OS command...

CVE-2018-18774: Improper Neutralization of Input During Web Page Generation

CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter...

PT-2018-14944

Name of the Vulnerable Software and Affected Versions GreenCMS version 2.3.0603 Description An issue was discovered that allows attackers to delete a log file due to a CSRF vulnerability. This can be achieved via the "index.php?m=admin&c=data&a=clear" URI. Recommendations For GreenCMS version...

CVE-2018-19376: Cross-Site Request Forgery (CSRF)

An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to delete a log file via the index.php?m=admin&c=data&a=clear URI...

CVE-2018-18801

The BSEN Ordering software 1.0 has SQL Injection via student/index.php?view=view&id=SQL or index.php?q=single-item&id=SQL...

CVE-2018-18801

The BSEN Ordering software 1.0 has SQL Injection via student/index.php?view=view&id=SQL or index.php?q=single-item&id=SQL...

PT-2018-14659

Name of the Vulnerable Software and Affected Versions School Event Management System version 1.0 Description The issue is related to SQL Injection, which can be exploited via the id parameter in the "student/index.php" or "event/index.php" API endpoints. Recommendations For School Event Managemen...

PT-2018-14663

Name of the Vulnerable Software and Affected Versions BSEN Ordering software version 1.0 Description The issue concerns SQL Injection. It can be exploited via the index.php endpoint, specifically through the id parameter in the URLs student/index.php?view=view&id=SQL or...

CVE-2018-18795: Improper Neutralization of Special Elements used in an SQL Command

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...

CVE-2018-18801: Improper Neutralization of Special Elements used in an SQL Command

The BSEN Ordering software 1.0 has SQL Injection via student/index.php?view=view&id=SQL or index.php?q=single-item&id=SQL...

PT-2018-14909

Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A CSRF issue allows deletion of a user or group via specific URIs, such as "admin/index.php/user/del/1" or "admin/index.php/role/del/2". Recommendations For DiliCMS version 2.4.0, as a temporary workaround,...

CVE-2018-19291: Cross-Site Request Forgery (CSRF)

An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI...