CVE-2018-16352: Unrestricted Upload of File with Dangerous Type

There is a PHP code upload vulnerability in WeaselCMS 0.3.6 via index.php because code can be embedded at the end of a .png file when the image/png content type is used...

CVE-2018-16354: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in FHCRM through 2018-02-11. There is a SQL injection via the index.php/User/read limit parameter...

PT-2018-13430

Name of the Vulnerable Software and Affected Versions waimai Super Cms version 20150505 Description The issue allows attackers to modify the price of items in a cart by exploiting a logic flaw. This can be done by observing data in a packet capture and setting the item totals parameter to zero in...

CVE-2018-15562

CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php...

CVE-2018-15562

CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php...

Code injection

CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php...

CVE-2018-15562

CMS ISWEB 3.5.3 is affected by a Cross-Site Scripting (XSS) vulnerability in index.php, exploitable via the parameters ordineRis, sezioneRicerca, or oggettiRicerca. The issue allows injection of arbitrary scripts/HTML, enabling remote attackers to run client-side code. Documented exploitation was...

CVE-2018-15562

CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php...

CVE-2018-15562: Improper Neutralization of Input During Web Page Generation

CMS ISWEB 3.5.3 has XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to index.php...

PT-2018-13087

Name of the Vulnerable Software and Affected Versions CMS ISWEB version 3.5.3 Description The issue allows for XSS via the ordineRis, sezioneRicerca, or oggettiRicerca parameter to the "index.php" endpoint. Recommendations For CMS ISWEB version 3.5.3, consider restricting the use of the ordineRis...

PT-2018-17692

Name of the Vulnerable Software and Affected Versions Infoblox NetMRI version 7.1.1 Description The issue is related to Reflected Cross-Site Scripting. It can be exploited via the "/api/docs/index.php" API endpoint, specifically through a query parameter. Recommendations For Infoblox NetMRI versi...

CVE-2018-6643: Improper Neutralization of Input During Web Page Generation

Infoblox NetMRI 7.1.1 has Reflected Cross-Site Scripting via the /api/docs/index.php query parameter...

Sql injection

A SQL injection was discovered in /coreframe/app/admin/pay/admin/index.php in WUZHI CMS 4.1.0 via the index.php?m=pay&f=index&v=listing keyValue parameter...

CVE-2018-15893

A SQL injection was discovered in /coreframe/app/admin/copyfrom.php in WUZHI CMS 4.1.0 via the index.php?m=core&f=copyfrom&v=listing keywords parameter...

CVE-2018-15894

A SQL injection was discovered in /coreframe/app/admin/pay/admin/index.php in WUZHI CMS 4.1.0 via the index.php?m=pay&f=index&v=listing keyValue parameter...

CVE-2018-15893

CVE-2018-15893: A SQL injection vulnerability exists in WUZHI CMS 4.1.0 in /coreframe/app/admin/copyfrom.php, exploitable via index.php?m=core&f=copyfrom&v=listing keywords parameter. NVD/OSV entries show CVSS v3.0 base score 9.8 (CRITICAL) and CVSS v2.0 base 7.5 with NETWORK attack vector and no...

PT-2018-13274

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A SQL injection issue was found in the /coreframe/app/admin/pay/admin/index.php file of WUZHI CMS. The issue is related to the keyValue parameter in the "index.php?m=pay&f=index&v=listing" API endpoint...

CVE-2018-15894: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection was discovered in /coreframe/app/admin/pay/admin/index.php in WUZHI CMS 4.1.0 via the index.php?m=pay&f=index&v=listing keyValue parameter...

CVE-2017-18345

The Joomanager component through 2.0.0 for Joomla! has an arbitrary file download issue, resulting in exposing the credentials of the database via an index.php?option=comjoomanager&controller=details&task=download&path=configuration.php request...

PT-2018-6842

Name of the Vulnerable Software and Affected Versions: Joomanager component for Joomla! versions through 2.0.0 Description: The issue allows for arbitrary file download, which can expose database credentials. This can be achieved through a request to "index.php?option=com...