13431 matches found
CVE-2012-6710
The CVE-2012-6710 issue affects eXtplorer (through version 2.1.2). It allows remote attackers to bypass authentication by sending password[]= (an empty array) in an action=login request to index.php, enabling unauthorized access. Affected component is ext_find_user; root cause is authentication b...
CVE-2012-6710
extfinduser in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password= aka an empty array in an action=login request to index.php...
CVE-2012-6710: Improper Authentication
extfinduser in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password= aka an empty array in an action=login request to index.php...
PT-2018-4062
Name of the Vulnerable Software and Affected Versions eXtplorer versions prior to 2.1.3 Description The issue allows remote attackers to bypass authentication. This can be achieved by sending an action=login request to "index.php" with a password variable set to an empty array. Recommendations Fo...
CVE-2018-17428
An issue was discovered in OPAC EasyWeb Five 5.7. There is SQL injection via the w2001/index.php?scelta=campi biblio parameter...
CVE-2018-17428
An issue was discovered in OPAC EasyWeb Five 5.7. There is SQL injection via the w2001/index.php?scelta=campi biblio parameter...
PT-2018-14024
Name of the Vulnerable Software and Affected Versions OPAC EasyWeb Five version 5.7 Description An issue was discovered that allows SQL injection via the "w2001/index.php?scelta=campi biblio" parameter. Recommendations For OPAC EasyWeb Five version 5.7, consider restricting access to the vulnerab...
CVE-2018-17428: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in OPAC EasyWeb Five 5.7. There is SQL injection via the w2001/index.php?scelta=campi biblio parameter...
WUZHICMS 2.0 - Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Title: WUZHICMS 2.0 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Vendor: http://www.wuzhicms.com Software: WUZHICMS 2.0 CVE: CVE-2018-17832 Technical Details & Description: A Cross Site Scripting vulnerability has been discovered in t...
CVE-2018-17830
The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted only values are restricted. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=&args substring...
Cross site scripting
XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter...
CVE-2018-17832
XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter...
CVE-2018-17830
The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted only values are restricted. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=&args substring...
CVE-2018-17831
In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rexlist class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rexlist were used...
CVE-2018-17832
WUZHICMS 2.0 is affected by a Cross-Site Scripting (XSS) vulnerability in index.php, exploitable via the v and f GET parameters. The issue is described as XSS in the WUZHICMS 2.0 web application, with PoC references showing injected content via index.php?v= and index.php?f=. No explicit root-caus...
CVE-2018-17852
A SQL injection was discovered in WUZHI CMS 4.1.0 in coreframe/app/coupon/admin/card.php via the groupname parameter to the /index.php?m=coupon&f=card&v=detaillisting URI...
PT-2018-14212
Name of the Vulnerable Software and Affected Versions WUZHI CMS version 2.0 Description A security issue exists due to the presence of XSS in the software. The issue is related to the v or f parameter in the "index.php" endpoint. Recommendations For WUZHI CMS version 2.0, consider restricting...
PT-2018-14211
Name of the Vulnerable Software and Affected Versions REDAXO versions prior to 5.6.3 Description A critical SQL injection issue has been found in the rex list class due to the prepareQuery function in core/lib/list.php. This can be exploited via the "sort" parameter in the...
PT-2018-14210
Name of the Vulnerable Software and Affected Versions REDAXO version 5.6.2 Description The issue concerns the $args variable in the addons/mediapool/pages/index.php file, where names are not restricted, allowing an attacker to insert XSS payloads. This can be achieved via the...