CVE-2018-17025

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage action for a page with no special role...

CVE-2018-17026: Improper Neutralization of Input During Web Page Generation

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage&name=error404 action, a different vulnerability than CVE-2018-10121...

PT-2018-13846

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns an XSS exploit via the page meta title parameter in the admin/index.php file when performing an edit page action for a page without a special role. Recommendations For Monstra CMS versio...

PT-2018-13847

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns an XSS vulnerability. It can be exploited via the page meta title parameter in an "edit page&name=error404" action on the "admin/index.php" page. Recommendations For Monstra CMS version...

PT-2018-13845

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns an XSS exploit via the page meta title parameter in the add page action. This is related to the admin/index.php file in Monstra CMS. Recommendations For Monstra CMS version 3.0.4, avoid...

CVE-2018-17024: Improper Neutralization of Input During Web Page Generation

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an addpage action...

CVE-2018-17025: Improper Neutralization of Input During Web Page Generation

admin/index.php in Monstra CMS 3.0.4 allows XSS via the pagemetatitle parameter in an editpage action for a page with no special role...

CVE-2018-16728

feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new...

CVE-2018-16728

feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new...

CVE-2018-16728: Improper Neutralization of Input During Web Page Generation

feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new...

PT-2018-13705

Name of the Vulnerable Software and Affected Versions feindura version 2.0.7 Description The issue allows for XSS via the tags field of a new page created at "index.php?category=0&page=new". Recommendations For feindura version 2.0.7, consider restricting access to the tags field in the new page...

mrklingo.freeshell.org XSS vulnerability

Open Bug Bounty ID: OBB-675088 Description| Value ---|--- Affected Website:| mrklingo.freeshell.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Arbitrary file deletion

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete...

CVE-2018-16774

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete...

CVE-2018-16773

EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field...

PT-2018-13647

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue allows an attacker with 'Editor' privileges to change the administrator's password due to an Insecure Direct Object Reference IDOR vulnerability. This can be achieved by accessing the...

PT-2018-13270

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns the improper restriction of modified Snippet content. This is demonstrated through the "admin/index.php?id=snippets&action=edit snippet&filename=google-analytics" URI, which allows...

PT-2018-13738

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue allows for arbitrary file deletion. This can be achieved by manipulating the file parameter in the /admin/index.php/language/ajax endpoint with a ../ sequence and setting the action parameter to...

CVE-2018-16773: Improper Neutralization of Input During Web Page Generation

EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field...

PT-2018-13737

Name of the Vulnerable Software and Affected Versions EasyCMS version 1.5 Description The issue allows for XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field. Recommendations For EasyCMS version 1.5, update to a version that includes a fix for...