CVE-2015-1503: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a 1 .. dot dot in the file parameter to a webmail/client/skins/default/css/css.php page or .../. dot dot dot slash dot in the 2 script or 3 style parameter to...

CVE-2018-10686

An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $REQUEST'path' to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a fileputcontents call in web/upload/UploadHandler.php...

PT-2018-10053

Name of the Vulnerable Software and Affected Versions Vesta Control Panel version 0.9.8-20 Description An issue was discovered that allows for Reflected XSS via the path variable in the view/file/index.php URI. This can potentially lead to remote PHP code execution through vectors involving a fil...

CVE-2018-10686: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $REQUEST'path' to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a fileputcontents call in web/upload/UploadHandler.php...

malfong.is XSS vulnerability

Open Bug Bounty ID: OBB-612518 Description| Value ---|--- Affected Website:| malfong.is Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-10570

Frog CMS 0.9.5 has XSS in /install/index.php via the 'config''adminusername' field...

PT-2018-9972

Name of the Vulnerable Software and Affected Versions: BigTree versions 4.2.22 and earlier Description: The issue allows remote attackers to upload and execute arbitrary PHP code. This is because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess...

PT-2018-9958

Name of the Vulnerable Software and Affected Versions: Nagios XI version 5.4.13 Description: A security issue was found that allows a registered user to use directory traversal to read local files. This can be achieved by using specific URIs, such as those beginning with "index.php?xiwindow=./" a...

CVE-2018-10570: Improper Neutralization of Input During Web Page Generation

Frog CMS 0.9.5 has XSS in /install/index.php via the 'config''adminusername' field...

CVE-2018-10553: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Nagios XI 5.4.13. A registered user is able to use directory traversal to read local files, as demonstrated by URIs beginning with index.php?xiwindow=./ and config/?xiwindow=../ substrings...

PT-2018-9968

Name of the Vulnerable Software and Affected Versions: Frog CMS version 0.9.5 Description: The issue concerns a security problem where an attacker can inject malicious code. The estimated number of potentially affected devices is not provided. The problem can be exploited through the...

Cross site request forgery (csrf)

An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...

CVE-2018-10503

An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...

PT-2018-9924

Name of the Vulnerable Software and Affected Versions: baijiacms V4 version v4 1 4 20170105 Description: An issue in index.php allows for CSRF attacks, enabling unauthorized actions such as adding an administrator account via "op=edituser", changing the administrator password via "op=changepwd", ...

CVE-2018-10503: Cross-Site Request Forgery (CSRF)

An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...

CVE-2018-10430

An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...

CVE-2018-10391

An issue was discovered in WUZHI CMS 4.1.0. There is XSS via the email parameter to the index.php?m=member&v=register URI...

PT-2018-9882

Name of the Vulnerable Software and Affected Versions: DiliCMS version 2.4.0 Description: A Stored XSS issue was found in the fourth textbox of "System setting-site setting" in admin/index.php, allowing for potential exploitation. Recommendations: For DiliCMS version 2.4.0, consider restricting...

CVE-2018-10391: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WUZHI CMS 4.1.0. There is XSS via the email parameter to the index.php?m=member&v=register URI...

CVE-2018-10430: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...