CVE-2018-16774: Improper Limitation of a Pathname to a Restricted Directory

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/language/ajax?action=delete...

CVE-2018-16608: Authorization Bypass Through User-Controlled Key

In Monstra CMS 3.0.4, an attacker with 'Editor' privileges can change the password of the administrator via an admin/index.php?id=users&action=edit&userid=1, Insecure Direct Object Reference IDOR...

Sql injection

An issue is discovered in baijiacms V4. Blind SQL Injection exists via the order parameter in an index.php?act=index request...

CVE-2018-16724

An issue is discovered in baijiacms V4. Blind SQL Injection exists via the order parameter in an index.php?act=index request...

CVE-2018-16724

The CVE-2018-16724 entry concerns baijiacms V4 with a reported Blind SQL Injection through the order parameter in the request using the path index.php?act=index . Connected documents corroborate this vulnerability as a SQL injection issue, with descriptions noting remote attackers could leverage ...

CVE-2018-16724

An issue is discovered in baijiacms V4. Blind SQL Injection exists via the order parameter in an index.php?act=index request...

PT-2018-13701

Name of the Vulnerable Software and Affected Versions baijiacms version V4 Description A Blind SQL Injection issue exists via the order parameter in an "index.php?act=index" request. Recommendations For baijiacms version V4, avoid using the order parameter in the "index.php?act=index" request unt...

CVE-2018-16724: Improper Neutralization of Special Elements used in an SQL Command

An issue is discovered in baijiacms V4. Blind SQL Injection exists via the order parameter in an index.php?act=index request...

CVE-2018-16654: Improper Neutralization of Input During Web Page Generation

Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1...

PT-2018-13675

Name of the Vulnerable Software and Affected Versions Zurmo version 3.2.4 Description The issue allows for XSS via the 'app/index.php/accounts/default/details' endpoint with specific parameters, including id, kanbanBoard, and openToTaskId. Recommendations For Zurmo version 3.2.4, update to a...

CVE-2018-16549

HScripts PHP File Browser Script v1.0 allows Directory Traversal via the index.php path parameter...

CVE-2018-16549

CVE-2018-16549 affects HScripts PHP File Browser Script v1.0. The vulnerability is a directory traversal flaw in the index.php path parameter that can enable reading of arbitrary files, as described by multiple sources (CNVD-2018-19431, RH and NVD entries). The root cause is improper validation o...

CVE-2018-15679

An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php?page=forums&action=search is vulnerable to reflected cross-site scripting...

PT-2018-13624

Name of the Vulnerable Software and Affected Versions HScripts PHP File Browser Script version 1.0 Description The issue allows Directory Traversal via the path parameter in index.php. Recommendations For HScripts PHP File Browser Script version 1.0, consider restricting access to the index.php...

PT-2018-13136

Name of the Vulnerable Software and Affected Versions BTITeam XBTIT version 2.5.4 Description An issue was discovered in the sign-up page available at /index.php?page=signup, where the act parameter is vulnerable to reflected cross-site scripting. Recommendations For version 2.5.4, consider...

PT-2018-13135

Name of the Vulnerable Software and Affected Versions BTITeam XBTIT version 2.5.4 Description The issue concerns a stored XSS exploit via the title of a news item in the newsfeed, accessible through the API endpoint "/index.php?page=viewnews". This exploit is also possible through CSRF...

CVE-2018-16549: Improper Limitation of a Pathname to a Restricted Directory

HScripts PHP File Browser Script v1.0 allows Directory Traversal via the index.php path parameter...

CVE-2018-15678: Improper Neutralization of Input During Web Page Generation

An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting...

CVE-2018-15679: Improper Neutralization of Input During Web Page Generation

An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php?page=forums&action=search is vulnerable to reflected cross-site scripting...

PT-2018-13583

Name of the Vulnerable Software and Affected Versions baigo CMS version 2.1.1 Description An issue in baigo CMS allows a CSRF attack via the index.php?m=article&c=request endpoint, potentially causing the publication of any article. Recommendations For baigo CMS version 2.1.1, consider disabling...