13439 matches found
zachskruer.no XSS vulnerability
Open Bug Bounty ID: OBB-651867 Description| Value ---|--- Affected Website:| zachskruer.no Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2018-14422
blog/index.php in SansCMS 0.7 has XSS via the q parameter...
CVE-2018-14420
MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=adminadmin&a=doaddsave URI...
Cross site request forgery (csrf)
SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address aka vpic to /admin/adminvideo.php aka /backend/adminvideo.php. The code is executed by visiting /details/index.php. This can also be exploited through CSRF...
Cross site request forgery (csrf)
MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=adminadmin&a=doaddsave URI...
CVE-2018-14422
blog/index.php in SansCMS 0.7 has XSS via the q parameter...
CVE-2018-14422
SansCMS 0.7 contains a cross-site scripting vulnerability in blog/index.php via the q parameter. The issue allows injection of arbitrary web script/HTML, with the impact described as partial integrity compromise and low confidentiality impact in CVSS terms. No precise exploit details are provided...
CVE-2018-14420: Cross-Site Request Forgery (CSRF)
MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?anyid=47&n=admin&c=adminadmin&a=doaddsave URI...
CVE-2018-14399: Improper Control of Generation of Code
libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php.jpg URI in the SRC attribute of an IMG element within infocontent JSON data to the index.php?m=member&c=index&a=register URI...
PT-2018-12502
Name of the Vulnerable Software and Affected Versions MetInfo version 6.0.0 Description The issue allows for a CSRF attack, enabling the addition of a user account through a doaddsave action to admin/index.php. This can be achieved by accessing a specific URI, such as...
CVE-2018-14422: Improper Neutralization of Input During Web Page Generation
blog/index.php in SansCMS 0.7 has XSS via the q parameter...
PT-2018-12504
Name of the Vulnerable Software and Affected Versions SansCMS version 0.7 Description The issue is related to a security problem where an attacker can inject malicious code. This is possible due to insufficient input validation in the q parameter of the 'blog/index.php' endpoint. Recommendations...
CVE-2018-14331: Cross-Site Request Forgery (CSRF)
An issue was discovered in XiaoCms X1 v20140305. There is a CSRF vulnerability to change the administrator account password via admin/index.php?c=index&a=my...
PT-2018-12446
Name of the Vulnerable Software and Affected Versions XiaoCms X1 version v20140305 Description An issue was discovered that allows for a CSRF vulnerability, enabling an attacker to change the administrator account password via the "admin/index.php?c=index&a=my" API endpoint. Recommendations For...
OpenSID Cross-Site Request Forgery Vulnerability
OpenSID is a village information management system developed by the SID community. A cross-site request forgery vulnerability exists in index.php/manuser/insert URI in OpenSID version 18.06-pasca, which can be exploited by an attacker to add an administrator-level account...
Weblication CMS Core & Grid '/grid5/scripts/' module cross-site scripting vulnerability
Weblication CMS Core & Grid is a content management system CMS that supports drag-and-drop website creation. A cross-site scripting vulnerability exists in the wFilemanager.php and index.php files of the '/grid5/scripts/' module in Weblication CMS Core & Grid version 12.6.24. A remote attacker ca...
torontohealthprofiles.ca XSS vulnerability
Open Bug Bounty ID: OBB-639591 Description| Value ---|--- Affected Website:| torontohealthprofiles.ca Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2018-13039
OpenSID 18.06-pasca has reflected Cross Site Scripting XSS via the cari parameter, aka an index.php/first?cari= URI...
