13431 matches found
PT-2018-14383
Name of the Vulnerable Software and Affected Versions BageCMS version 3.1.3 Description An issue was discovered that allows an attacker to delete any files and folders on the web server via a directory traversal attack using specific URI requests, such as...
CVE-2018-18209
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenttype parameter...
CVE-2018-18210
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenturl parameter...
PT-2018-14369
Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A security issue exists due to the presence of XSS in the attachment type parameter of the "admin/index.php/setting/site?tab=site attachment" endpoint. Recommendations For DiliCMS version 2.4.0, avoid using th...
PT-2018-14371
Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A security issue exists due to the presence of XSS in the attachment url parameter of the "admin/index.php/setting/site?tab=site attachment" endpoint. Recommendations For DiliCMS version 2.4.0, avoid using the...
CVE-2018-18210: Improper Neutralization of Input During Web Page Generation
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenturl parameter...
CVE-2018-18209: Improper Neutralization of Input During Web Page Generation
XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/site?tab=siteattachment attachmenttype parameter...
CVE-2018-18198
The $openerinputfield variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=XSS request...
CVE-2018-18198
The $openerinputfield variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=XSS request...
CVE-2018-18198
The CVE-2018-18198 issue affects REDAXO 5.6.3 via addons/mediapool/pages/index.php where the $opener_input_field is not properly filtered and is echoed to the page. This allows an attacker to inject XSS payloads through a request such as index.php?page=mediapool/media&opener_input_field=[XSS]. Re...
CVE-2018-18075
WikidForum 2.20 has SQL Injection via the rpc.php parentpostid or numrecords parameter, or the index.php?action=search selectsort parameter...
Sql injection
WikidForum 2.20 has SQL Injection via the rpc.php parentpostid or numrecords parameter, or the index.php?action=search selectsort parameter...
CVE-2018-18075
WikidForum 2.20 has SQL Injection via the rpc.php parentpostid or numrecords parameter, or the index.php?action=search selectsort parameter...
CVE-2018-18075
WikidForum 2.20 is affected by an SQL Injection vulnerability exposed via the rpc.php (parent_post_id or num_records) parameters, or the index.php?action=search (select_sort) parameter. The issue, reported across multiple sources, indicates that unsafely constructed SQL queries can be influenced ...
PT-2018-14363
Name of the Vulnerable Software and Affected Versions qibosoft version 7.0 Description The issue allows for a CSRF attack, enabling an attacker to add a user account. This can be achieved through the "admin/index.php?lfj=member&action=addmember" API endpoint. Recommendations For qibosoft version...
PT-2018-14360
Name of the Vulnerable Software and Affected Versions REDAXO version 5.6.3 Description The issue concerns the $opener input field variable in the addons/mediapool/pages/index.php file, which is not properly filtered and is directly output to the page. An attacker can exploit this by inserting XSS...
PT-2018-14335
Name of the Vulnerable Software and Affected Versions WikidForum version 2.20 Description The issue concerns SQL Injection, which can be exploited through specific parameters in the software. The vulnerable parameters include parent post id and num records in the 'rpc.php' endpoint, as well as th...
CVE-2018-18075: Improper Neutralization of Special Elements used in an SQL Command
WikidForum 2.20 has SQL Injection via the rpc.php parentpostid or numrecords parameter, or the index.php?action=search selectsort parameter...
CVE-2018-18198: Improper Neutralization of Input During Web Page Generation
The $openerinputfield variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=XSS request...