13431 matches found
PT-2018-14590
Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A CSRF issue allows changing the super administrator's username via the "index.php?m=member&f=index&v=edit&uid=1" endpoint, specifically targeting the uid variable set to 1, which corresponds to the super...
PT-2018-14582
Name of the Vulnerable Software and Affected Versions PhpTpoint Pharmacy Management System affected versions not specified Description The issue is related to a SQL injection vulnerability. It affects the username parameter in the "index.php" endpoint. Recommendations At the moment, there is no...
CVE-2018-18712: Cross-Site Request Forgery (CSRF)
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's username via index.php?m=member&f=index&v=edit&uid=1...
CVE-2018-18704: Improper Neutralization of Special Elements used in an SQL Command
PhpTpoint Pharmacy Management System suffers from a SQL injection vulnerability in the index.php username parameter...
PT-2018-14589
Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A CSRF issue allows changing the super administrator's password via the "index.php?m=core&f=panel&v=edit info" API endpoint. Recommendations For WUZHI CMS version 4.1.0, update to a newer version that contai...
CVE-2018-18711: Cross-Site Request Forgery (CSRF)
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=editinfo...
PT-2018-14583
Name of the Vulnerable Software and Affected Versions PhpTpoint hospital management system affected versions not specified Description The issue concerns SQL injection vulnerabilities. These vulnerabilities can be exploited via the user parameter in index.php associated with LOGIN.php, or the rno...
CVE-2018-18705: Improper Neutralization of Special Elements used in an SQL Command
PhpTpoint hospital management system suffers from multiple SQL injection vulnerabilities via the index.php user parameter associated with LOGIN.php, or the rno parameter to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php...
PT-2018-14575
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns stored XSS that can be triggered by remote authenticated administrators. This occurs when a file without an extension is uploaded, and in certain cases, this file is interpreted as...
CVE-2018-18694: Improper Neutralization of Input During Web Page Generation
admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases...
CVE-2018-18622
CVE-2018-18622 affects Waimai Super Cms 20150505. The issue is a Cross-Site Scripting (XSS) vulnerability exploitable through the username parameter in index.php?m=public&a=doregister, as reported by multiple sources (Red Hat, CNVD, NVD). Root cause is unsanitized input that allows injection of s...
PT-2018-14544
Name of the Vulnerable Software and Affected Versions Waimai Super Cms version 20150505 Description An issue was discovered that allows for XSS via the "index.php?m=public&a=doregister" endpoint, specifically through the username parameter. Recommendations For Waimai Super Cms version 20150505,...
CVE-2018-18626: Undefined Security Weakness
An issue was discovered in PHPYun V4.6. There is a vulnerability that can delete any file or directory via the "admin/index.php?m=database&c=del" sql parameter because delaction in admin/model/database.class.php mishandles this parameter...
CVE-2018-18622: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Waimai Super Cms 20150505. There is XSS via the index.php?m=public&a=doregister username parameter...
CVE-2018-18417
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI...
CVE-2018-18417
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI...
PT-2018-14448
Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM version 3.1 Description A Stored XSS issue has been found in the input and upload sections of the software. This is demonstrated by the name parameter to the "index.php/admin/client/create" URI. Recommendations For...
CVE-2018-18417: Improper Neutralization of Input During Web Page Generation
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI...
Ekushey Project Manager CRM 3.1 Cross Site Scripting Vulnerability
Ekushey Project Manager CRM version 3.1 suffers from a persistent cross site scripting vulnerability. Exploit Title: Ekushey Project Manager CRM 3.1 - Cross-site Scripting Exploit Author: Ismail Tasdelen Vendor Homepage: http://creativeitem.com/ Software Link : http://creativeitem.com/demo/ekushe...