PT-2018-11553

Name of the Vulnerable Software and Affected Versions OpenSID version 18.06-pasca Description The issue is related to reflected Cross Site Scripting XSS that can be triggered via the cari parameter in an index.php/first?cari= URI. This allows for potential malicious script injection...

PT-2018-11554

Name of the Vulnerable Software and Affected Versions OpenSID version 18.06-pasca Description The issue allows an attacker to add an account at the admin level. This is achieved via the "index.php/man user/insert" API endpoint. Recommendations For OpenSID version 18.06-pasca, consider restricting...

CVE-2018-13040: Cross-Site Request Forgery (CSRF)

OpenSID 18.06-pasca has a CSRF vulnerability. This vulnerability can add an account at the admin level via the index.php/manuser/insert URI...

CVE-2018-13002

An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the wFilemanager.php and index.php files of the /grid5/scripts/ modules. The injection point is located in the Project Title and the execution point occurs in the Inhaltsprojekt...

CVE-2018-13010

WSTMall v1.9.1_170316 is affected by a Cross-Site Request Forgery (CSRF) that can be exploited via the URL index.php?m=Admin&c=Users&a=edit to add a user account. The CVE-2018-13010 entry is corroborated by multiple sources (NVD entry and CNVD/Red Hat/PRION mirrors) describing CSRF to create new ...

Arbitrary file deletion

GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI...

CVE-2018-12988

GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI...

CVE-2018-12988

GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI...

CVE-2018-12971

EasyCMS 1.3 is affected by a CSRF vulnerability that allows deleting users via the index.php?s=/admin/user/delAll URI. Multiple sources (NVD/NVD-derived entries, CVE lists, CNVD) corroborate that this is a CSRF flaw targeting the admin user deletion endpoint. The exact impact is deletion of users...

CVE-2018-12988

GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI...

CVE-2018-13010: Cross-Site Request Forgery (CSRF)

WSTMall v1.9.1170316 has CSRF via the index.php?m=Admin&c=Users&a=edit URI to add a user account...

CVE-2018-12988: Improper Input Validation

GreenCMS 2.3.0603 has an arbitrary file download vulnerability via an index.php?m=admin&c=media&a=downfile URI...

PT-2018-11531

Name of the Vulnerable Software and Affected Versions Weblication CMS Core & Grid version 12.6.24 Description A cross-site scripting XSS issue was found in the Weblication CMS Core & Grid. The vulnerability is located in the wFilemanager.php and index.php files of the /grid5/scripts/ modules. The...

CVE-2018-13002: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the wFilemanager.php and index.php files of the /grid5/scripts/ modules. The injection point is located in the Project Title and the execution point occurs in the Inhaltsprojekt...

PT-2018-11517

Name of the Vulnerable Software and Affected Versions GreenCMS version 2.3.0603 Description The issue allows for an arbitrary file download via the /index.php?m=admin&c=media&a=downfile API endpoint. Recommendations For GreenCMS version 2.3.0603, consider restricting access to the downfile action...

PT-2018-11545

Name of the Vulnerable Software and Affected Versions YXcms version 1.4.7 Description The issue allows remote attackers to delete arbitrary files. This is achieved through the index.php?r=admin/photo/delpic endpoint, specifically by manipulating the picname parameter. Recommendations For YXcms...

PT-2018-11504

Name of the Vulnerable Software and Affected Versions EasyCMS version 1.3 Description The issue allows for CSRF via the "index.php?s=/admin/user/delAll" URI to delete users. Recommendations For EasyCMS version 1.3, consider implementing proper CSRF protection mechanisms, such as token-based...

CVE-2018-12971: Cross-Site Request Forgery (CSRF)

EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users...

CVE-2018-13025: Incorrect Permission Assignment for Critical Resource

protected/apps/admin/controller/photoController.php in YXcms 1.4.7 allows remote attackers to delete arbitrary files via the index.php?r=admin/photo/delpic picname parameter...

PT-2018-11541

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description An issue was discovered that allows for Arbitrary Script File Upload, which can result in PHP code execution. This is achievable via the "admin/index.php/template/upload" API endpoint. Recommendations For...