CVE-2018-11493

WUZHI CMS 4.1.0 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that can add a friendship link via index.php?m=link&f=index&v=add. The issue is documented under CVE-2018-11493. Connected sources confirm the affected software/version and the specific vulnerable endpoint. The exist...

CVE-2018-11493: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add a friendship link via index.php?m=link&f=index&v=add...

CVE-2018-11495: Improper Limitation of a Pathname to a Restricted Directory

OpenCart through 3.0.2.0 allows directory traversal in the editDownload function in admin\model\catalog\download.php via admin/index.php?route=catalog/download/edit, related to the downloadid. For example, an attacker can download ../../config.php...

PT-2018-10591

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns a Reflected XSS that occurs during the login process, specifically involving the login parameter to the admin/index.php endpoint. Recommendations For Monstra CMS version 3.0.4, update to...

PT-2018-10593

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns a session management problem in the Administrations Tab of Monstra CMS. Specifically, changing a password at the "admin/index.php?id=users&action=edit&user id=1" endpoint does not...

CVE-2018-11472: Improper Neutralization of Input During Web Page Generation

Monstra CMS 3.0.4 has Reflected XSS during Login i.e., the login parameter to admin/index.php...

juwelier-petersen.de XSS vulnerability

Open Bug Bounty ID: OBB-620002 Description| Value ---|--- Affected Website:| juwelier-petersen.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-11092

An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table aka Clear Table action...

CVE-2018-11092: Cross-Site Request Forgery (CSRF)

An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table aka Clear Table action...

PT-2018-10303

Name of the Vulnerable Software and Affected Versions MyBB Admin Notes plugin version 1.1 Description An issue allows an attacker to remotely delete all admin notes. This can be achieved via the "admin/index.php?empty=table" action, which is vulnerable to CSRF. Recommendations For MyBB Admin Note...

forum-tc.msi.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-617657 Description| Value ---|--- Affected Website:| forum-tc.msi.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

PT-2018-10120

Name of the Vulnerable Software and Affected Versions LiveZilla Live Chat versions prior to 7.0.9.5 Description The issue affects the chat/mobile/index.php file in LiveZilla Live Chat, where a Cross-Site Scripting vulnerability can be exploited via the Accept-Language HTTP header. Recommendations...

CVE-2018-10810: Improper Neutralization of Input During Web Page Generation

chat/mobile/index.php in LiveZilla Live Chat 7.0.9.5 and prior is affected by Cross-Site Scripting via the Accept-Language HTTP header...

WUZHI CMS 4.1.0 - tag[pinyin] Cross-Site Scripting

WUZHI CMS 4.1.0 - tagpinyin Cross-Site Scripting Exploit Title: WUZHI CMS 4.1.0 XSS Vulnerability Date: 2018-4-23 Exploit Author: jiguang [email protected] Vendor Homepage: https://github.com/wuzhicms/wuzhicms Software Link: https://github.com/wuzhicms/wuzhicms Version: 4.1.0 CVE: CVE-2018-10311 An...

CVE-2018-11003: Cross-Site Request Forgery (CSRF)

An issue was discovered in YXcms 1.4.7. Cross-site request forgery CSRF vulnerability in protected/apps/admin/controller/adminController.php allows remote attackers to delete administrator accounts via index.php?r=admin/admin/admindel...

PT-2018-10236

Name of the Vulnerable Software and Affected Versions YXcms version 1.4.7 Description A cross-site request forgery issue allows remote attackers to delete administrator accounts. The issue is related to the "index.php?r=admin/admin/admindel" endpoint, specifically in the...

nordichem.eu XSS vulnerability

Open Bug Bounty ID: OBB-615179 Description| Value ---|--- Affected Website:| nordichem.eu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

thinkphp SQL Injection Vulnerability (CNVD-2018-09389)

thinkphp is a set of open source, PHP-based lightweight web application development framework. A SQL injection vulnerability exists in thinkphp version 3.1.3. A remote attacker can use the 's' parameter to send a specially crafted SQL statement to the index.php file to exploit the vulnerability t...

CVE-2015-1503: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a 1 .. dot dot in the file parameter to a webmail/client/skins/default/css/css.php page or .../. dot dot dot slash dot in the 2 script or 3 style parameter to...

CVE-2018-10686

An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $REQUEST'path' to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a fileputcontents call in web/upload/UploadHandler.php...