13437 matches found
CVE-2018-14873
An issue was discovered in Rincewind 0.1. There is a cross-site scripting XSS vulnerability involving a p=account request to index.php and another file named commonPages.php...
Design/Logic Flaw
An issue was discovered in DataLife Engine DLE through 13.0. An attacker can use XSS related to the /addnews.html and /index.php?do=addnews URIs to send a malicious script to unsuspecting Admins or users...
CVE-2018-14777: Improper Neutralization of Input During Web Page Generation
An issue was discovered in DataLife Engine DLE through 13.0. An attacker can use XSS related to the /addnews.html and /index.php?do=addnews URIs to send a malicious script to unsuspecting Admins or users...
PT-2018-12716
Name of the Vulnerable Software and Affected Versions DataLife Engine versions prior to 13.0 Description An issue was discovered that allows an attacker to use XSS to send a malicious script to unsuspecting Admins or users, related to the "/addnews.html" and "/index.php?do=addnews" API Endpoints...
PT-2018-12659
Name of the Vulnerable Software and Affected Versions Gxlcms version 1.1.4 Description The issue allows remote attackers to read arbitrary files. This is related to a crafted request to the "index.php?s=Admin-Tpl-ADD-id" endpoint, specifically targeting the add function in the TplAction.class.php...
CVE-2018-14685: Exposure of Sensitive Information to an Unauthorized Actor
The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitrary files via a crafted index.php?s=Admin-Tpl-ADD-id request, related to Lib/Common/Admin/function.php...
Cross site request forgery (csrf)
index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account...
CVE-2018-14582
index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account...
CVE-2018-14582: Cross-Site Request Forgery (CSRF)
index.php?r=admini/admin/create in BageCMS V3.1.3 allows CSRF to add a background administrator account...
PT-2018-12592
Name of the Vulnerable Software and Affected Versions BageCMS version 3.1.3 Description The issue allows for CSRF to add a background administrator account through the "index.php?r=admini/admin/create" endpoint. Recommendations For BageCMS version 3.1.3, consider implementing CSRF protection...
Cross site scripting
An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formnickname parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the "system settings - mail server"...
CVE-2018-14515
A SQL injection was discovered in WUZHI CMS 4.1.0 that allows remote attackers to inject a malicious SQL statement via the index.php?m=promote&f=index&v=search keywords parameter...
CVE-2018-14515
CVE-2018-14515 affects WUZHI CMS 4.1.0 and enables a remote SQL injection through the parameter in the URL index.php?m=promote&f=index&v=search keywords. Public reports describe an injection vector in the search keywords field, allowing attacker-controlled SQL statements. NVD lists CVSSv2 base sc...
CVE-2018-14513: Improper Neutralization of Input During Web Page Generation
An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formcontent parameter to the index.php?m=feedback&f=index&v=contact URI...
CVE-2018-14512: Improper Neutralization of Input During Web Page Generation
An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formnickname parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the "system settings - mail server"...
CVE-2018-14515: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection was discovered in WUZHI CMS 4.1.0 that allows remote attackers to inject a malicious SQL statement via the index.php?m=promote&f=index&v=search keywords parameter...
PT-2018-12559
Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A SQL injection issue was found that allows remote attackers to inject malicious SQL statements via the "index.php?m=promote&f=index&v=search keywords" parameter. Recommendations For WUZHI CMS version 4.1.0,...
PT-2018-12557
Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A persistent XSS issue was found, allowing remote attackers to inject arbitrary web script or HTML via the formcontent parameter to the "index.php?m=feedback&f=index&v=contact" API endpoint. Recommendations...
zachskruer.no XSS vulnerability
Open Bug Bounty ID: OBB-651867 Description| Value ---|--- Affected Website:| zachskruer.no Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...