Cross site request forgery (csrf)

An issue was discovered in fledrCMS through 2014-02-03. There is a CSRF vulnerability that can change the administrator's password via index.php?p=done&savedata=1...

CVE-2018-15850: Cross-Site Request Forgery (CSRF)

An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an administrator account via index.php?page=user...

CVE-2018-15846: Cross-Site Request Forgery (CSRF)

An issue was discovered in fledrCMS through 2014-02-03. There is a CSRF vulnerability that can change the administrator's password via index.php?p=done&savedata=1...

PT-2018-13240

Name of the Vulnerable Software and Affected Versions REDAXO CMS version 4.7.2 Description An issue was discovered that allows for a CSRF vulnerability, enabling the addition of an administrator account via the "index.php?page=user" endpoint. The page and user parameters are involved in this issu...

PT-2018-13235

Name of the Vulnerable Software and Affected Versions fledrCMS versions prior to 2014-02-03 Description An issue was discovered that allows a CSRF vulnerability to change the administrator's password. This can be done via the "index.php?p=done&savedata=1" endpoint. Recommendations For versions...

Twitter-Clone 1 - userid SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Twitter-Clone 1 - 'userid' SQL Injection Exploit Author: L0RD Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/ Version: 1 CVE: N/A Tested on: Win 10 POC : SQLi vulnerable files : follow.php , index.php vulnerable...

Twitter-Clone 1 - userid SQL Injection

Twitter-Clone 1 - userid SQL Injection Exploit Title: Twitter-Clone 1 - 'userid' SQL Injection Date: 2018-08-21 Exploit Author: L0RD Vendor Homepage: https://github.com/Fyffe/PHP-Twitter-Clone/ Version: 1 CVE: N/A Tested on: Win 10 POC : SQLi vulnerable files : follow.php , index.php vulnerable...

CVE-2018-15203

An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/addpage allows a CSRF attack to add pages...

CVE-2018-15203: Cross-Site Request Forgery (CSRF)

An issue was discovered in Ignited CMS through 2017-02-19. ign/index.php/admin/pages/addpage allows a CSRF attack to add pages...

CVE-2018-15177: Cross-Site Request Forgery (CSRF)

In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account...

PT-2018-12925

Name of the Vulnerable Software and Affected Versions Gxlcms version 2.0 Description The issue allows for a CSRF attack, which can be used to add an administrator account through the news/index.php?s=Admin-Admin-Insert endpoint. Recommendations For Gxlcms version 2.0, consider implementing CSRF...

CVE-2018-15130

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter...

CVE-2018-15130

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter...

CVE-2018-15130

CVE-2018-15130 affects ThinkSAAS up to 2018-07-25. The vulnerability is a Cross-Site Scripting (XSS) flaw exploitable via the parameter groupdesc in the URL path index.php?app=group&ac=create&ts=do, allowing injection of arbitrary web script/HTML into the page. Root cause details beyond XSS are n...

CVE-2018-15129

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter...

CVE-2018-15129

ThinkSAAS up to 2018-07-25 is affected by a cross-site scripting (XSS) flaw in the content parameter for the article comment endpoint (index.php?app=article&ac=comment&ts=do content). The issue arises from user-supplied content being reflected without proper sanitization, enabling XSS. Connected ...

PT-2018-12888

Name of the Vulnerable Software and Affected Versions ThinkSAAS versions prior to 2018-07-25 Description The issue allows for XSS via the index.php?app=group&ac=create&ts=do endpoint, specifically through the groupdesc parameter. Recommendations For versions prior to 2018-07-25, avoid using the...

CVE-2018-15130: Improper Neutralization of Input During Web Page Generation

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter...

PT-2018-12886

Name of the Vulnerable Software and Affected Versions ThinkSAAS versions prior to 2018-07-25 Description The issue allows for XSS via the content parameter in the "index.php?app=article&ac=comment&ts=do" endpoint. Recommendations For versions prior to 2018-07-25, update to a version released afte...

CVE-2018-15129: Improper Neutralization of Input During Web Page Generation

ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter...