13441 matches found
CVE-2018-11679: Cross-Site Request Forgery (CSRF)
An issue was discovered in CmsEasy 6.120180508. There is a CSRF vulnerability that can add an article via /index.php?case=table&act=add&table=archive&admindir=admin...
PT-2018-10743
Name of the Vulnerable Software and Affected Versions CmsEasy version 6.1 20180508 Description A CSRF issue allows adding an article via the /index.php?case=table&act=add&table=archive&admin dir=admin endpoint. Recommendations For CmsEasy version 6.1 20180508, as a temporary workaround, consider...
vehiculesutilitairesmag.com XSS vulnerability
Open Bug Bounty ID: OBB-625745 Description| Value ---|--- Affected Website:| vehiculesutilitairesmag.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Cross site request forgery (csrf)
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php?m=admin&c=access&a=adduserhandle...
CVE-2018-11671
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php?m=admin&c=access&a=adduserhandle...
CVE-2018-11670
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary PHP code via the content parameter to index.php?m=admin&c=media&a=fileconnect...
CVE-2018-11670: Cross-Site Request Forgery (CSRF)
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary PHP code via the content parameter to index.php?m=admin&c=media&a=fileconnect...
CVE-2018-11671: Cross-Site Request Forgery (CSRF)
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php?m=admin&c=access&a=adduserhandle...
PT-2018-10740
Name of the Vulnerable Software and Affected Versions GreenCMS version 2.3.0603 Description A CSRF issue allows attackers to execute arbitrary PHP code via the content parameter to "index.php?m=admin&c=media&a=fileconnect" API endpoint. Recommendations For GreenCMS version 2.3.0603, as a temporar...
PT-2018-10741
Name of the Vulnerable Software and Affected Versions GreenCMS version 2.3.0603 Description An issue was discovered that allows for a CSRF vulnerability, enabling the addition of an admin account via the "index.php?m=admin&c=access&a=adduserhandle" endpoint. Recommendations For GreenCMS version...
Cross site scripting
DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" newlastname parameter...
CVE-2018-11558
DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" newfirstname parameter...
CVE-2018-11558
CVE-2018-11558 is a stored XSS vulnerability in DomainMod 4.10.0, exploiting the new_first_name parameter in the "/settings/profile/index.php" page. The connected documents consistently describe the issue as a cross-site scripting flaw affecting DomainMod 4.10.0, with multiple sources naming the ...
CVE-2018-11559
DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" newlastname parameter...
CVE-2018-11559
DomainMod 4.10.0 is affected by a Stored XSS in the profile settings endpoint (/settings/profile/index.php) via the new_last_name parameter. Root cause: persistent injection in the user profile handling leading to script execution when viewed. Impact is limited to what the XSS allows per the sour...
PT-2018-10667
Name of the Vulnerable Software and Affected Versions DomainMod version 4.10.0 Description The issue concerns a Stored XSS in the "/settings/profile/index.php" new last name parameter. Recommendations For DomainMod version 4.10.0, avoid using the new last name parameter in the...
CVE-2018-11558: Improper Neutralization of Input During Web Page Generation
DomainMod 4.10.0 has Stored XSS in the "/settings/profile/index.php" newfirstname parameter...
PT-2018-10666
Name of the Vulnerable Software and Affected Versions DomainMod version 4.10.0 Description The issue concerns a Stored XSS in the "/settings/profile/index.php" new first name parameter. Recommendations For DomainMod version 4.10.0, update to a version that fixes this issue, as using the new first...
CVE-2018-11495
OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\model\catalog\download.php via admin/index.php?route=catalog/download/edit, related to the downloadid. For example, an attacker can download ../../config.php...