CVE-2018-16458: Cross-Site Request Forgery (CSRF)

An issue was discovered in baigo CMS v2.1.1. There is an index.php?m=article&c=request CSRF that can cause publication of any article...

PT-2018-13526

Name of the Vulnerable Software and Affected Versions IdeaCMS versions through 2016-04-30 Description The issue is related to a reflected XSS that can be exploited via the kw parameter in the "index.php?c=content&a=search" endpoint. The product is discontinued. Recommendations For IdeaCMS version...

CVE-2018-16372: Improper Neutralization of Input During Web Page Generation

The issue was discovered in IdeaCMS through 2016-04-30. There is reflected XSS via the index.php?c=content&a=search kw parameter. NOTE: this product is discontinued...

CVE-2018-16352

There is a PHP code upload vulnerability in WeaselCMS 0.3.6 via index.php because code can be embedded at the end of a .png file when the image/png content type is used...

CVE-2018-16353

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the /index.php/Customer/read limit parameter...

Sql injection

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter...

CVE-2018-16352

There is a PHP code upload vulnerability in WeaselCMS 0.3.6 via index.php because code can be embedded at the end of a .png file when the image/png content type is used...

CVE-2018-16354

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter...

CVE-2018-16354

CVE-2018-16354 affects FHCRM (free/open source product management system). The connected CNVD/CVE records describe a SQL injection vulnerability exposed by the index.php/User/read limit parameter, with attackers potentially executing arbitrary SQL commands. FHCRM versions up to 2018-02-11 are imp...

Design/Logic Flaw

WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic formstatcode parameter...

PT-2018-13509

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue is related to a form parameter in a specific page. The remark parameter in the form on the page index.php?m=link&f=index&v=add is vulnerable to XSS attacks. Recommendations For WUZHI CMS version...

PT-2018-13512

Name of the Vulnerable Software and Affected Versions FHCRM versions prior to 2018-02-11 Description An issue was discovered that allows SQL injection via the "/index.php/Customer/read" API endpoint, specifically through the limit parameter. Recommendations For versions prior to 2018-02-11,...

CVE-2018-16349: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 has XSS via the index.php?m=link&f=index&v=add formremark parameter...

PT-2018-13510

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue is related to a form parameter in a specific PHP file, allowing for XSS attacks. The vulnerable parameter is statcode in the form on the page index.php?m=core&f=set&v=basic. Recommendations For WUZ...

CVE-2018-16350: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic formstatcode parameter...

PT-2018-13511

Name of the Vulnerable Software and Affected Versions WeaselCMS version 0.3.6 Description The issue concerns a PHP code upload vulnerability. It can be exploited by embedding code at the end of a .png file when the image/png content type is used, specifically affecting the index.php file...

PT-2018-13513

Name of the Vulnerable Software and Affected Versions FHCRM versions prior to 2018-02-11 Description An issue was discovered that allows SQL injection via the limit parameter in the "index.php/User/read" endpoint. Recommendations For versions prior to 2018-02-11, consider restricting access to th...

CVE-2018-16353: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the /index.php/Customer/read limit parameter...

PT-2018-13505

Name of the Vulnerable Software and Affected Versions EasyCMS version 1.5 Description An issue was discovered that allows for a CSRF vulnerability, enabling the update of the admin password. This is achieved via the index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...

CVE-2018-16345: Cross-Site Request Forgery (CSRF)

An issue was discovered in EasyCMS 1.5. There is a CSRF vulnerability that can update the admin password via index.php?s=/admin/rbacuser/update/navTabId/listusers/callbackType/closeCurrent...