13436 matches found
CVE-2018-16820
admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests...
CVE-2018-16819
admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&deletefile= requests...
CVE-2018-16820
Monstra CMS 3.0.4 is affected by a directory-traversal in admin/index.php, exploitable via id=filesmanager&path=uploads/… requests to list arbitrary directories. Root cause is improper handling of the path parameter that enables traversal. Impact per NVD: High (CVSSv3 7.5) for confidentiality los...
CVE-2018-16819: Improper Limitation of a Pathname to a Restricted Directory
admin/index.php in Monstra CMS 3.0.4 allows arbitrary file deletion via id=filesmanager&path=uploads/.......//./.......//./&deletefile= requests...
PT-2018-13760
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns arbitrary file deletion in Monstra CMS. An attacker can exploit this by sending a request to the "admin/index.php" endpoint with specific parameters, including id, path, and delete file...
PT-2018-13761
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue allows for arbitrary directory listing. This can be achieved by sending a request to the "admin/index.php" endpoint with specific parameters, such as id=filesmanager and...
CVE-2018-16820: Improper Limitation of a Pathname to a Restricted Directory
admin/index.php in Monstra CMS 3.0.4 allows arbitrary directory listing via id=filesmanager&path=uploads/.......//./.......//./ requests...
CVE-2018-17035
The vulnerability CVE-2018-17035 affects UCMS 1.4.6, where an SQL injection can occur during installation via the install/index.php mysql_dbname parameter. Affected component is UCMS (PHP-based CMS); root cause is unsafely handled mysql_dbname input during setup, enabling potential SQL command ex...
CVE-2018-17034
UCMS 1.4.6 contains a Cross-Site Scripting (XSS) vulnerability controllable via the mysql_dbname parameter in install/index.php. Multiple connected sources (NVD entry CVE-2018-17034 and CNVD/CVE listings) confirm an XSS flaw capable of injecting arbitrary scripts/HTML in affected users’ browsers....
CVE-2018-17034
UCMS 1.4.6 has XSS via the install/index.php mysqldbname parameter...
CVE-2018-17036
An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...
CVE-2018-17036: Improper Control of Generation of Code
An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...
CVE-2018-17034: Improper Neutralization of Input During Web Page Generation
UCMS 1.4.6 has XSS via the install/index.php mysqldbname parameter...
CVE-2018-17035: Improper Neutralization of Special Elements used in an SQL Command
UCMS 1.4.6 has SQL injection during installation via the install/index.php mysqldbname parameter...
PT-2018-13850
Name of the Vulnerable Software and Affected Versions UCMS version 1.4.6 Description The issue is related to a security problem where an attacker can execute malicious scripts. This is possible due to the lack of proper input validation in the mysql dbname parameter of the install/index.php file...
PT-2018-13851
Name of the Vulnerable Software and Affected Versions UCMS version 1.4.6 Description The issue is related to SQL injection that occurs during the installation process. Specifically, the mysql dbname parameter in the install/index.php endpoint is vulnerable. Recommendations For version 1.4.6, avoi...
PT-2018-13852
Name of the Vulnerable Software and Affected Versions UCMS versions 1.4.6 through 1.6 Description An issue allows PHP code injection during installation via the systemdomain parameter to "install/index.php", as demonstrated by injecting a phpinfo call into /inc/config.php. Recommendations For UCM...
CVE-2018-17024
admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an addpage action...
CVE-2018-17025
CVE-2018-17025 affects Monstra CMS 3.0.4. The issue is an XSS in admin/index.php via the page_meta_title parameter in an edit_page action for pages with no special role. Documented impact is XSS; no exploitation details are provided in the sources. CVSS scores listed: CVSS v2 base 4.3 (Medium) an...