CVE-2018-10248: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can delete any article via index.php?m=content&f=content&v=recycledelete...

PT-2018-9782

Name of the Vulnerable Software and Affected Versions: baijiacms V3 Description: The issue allows for CSRF via the "index.php?mod=site&op=edituser&name=manager&do=user" API endpoint to add an administrator account. Recommendations: For baijiacms V3, as a temporary workaround, consider restricting...

CVE-2018-10249: Cross-Site Request Forgery (CSRF)

baijiacms V3 has CSRF via index.php?mod=site&op=edituser&name=manager&do=user to add an administrator account...

CVE-2018-10225

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

Sql injection

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

CVE-2018-10221

An issue was discovered in WUZHI CMS V4.1.0. There is a persistent XSS vulnerability that can steal the administrator cookies via the tagtag parameter to the index.php?m=tags&f=index&v=add&&su=wuzhicms URI. After a website editor whose privilege is lower than the administrator logs in, he can add...

CVE-2018-10219

baijiacms V3 has physical path leakage via an index.php?mod=mobile&name=member&do=index request...

CVE-2018-10225

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

CVE-2018-10219

baijiacms V3 has physical path leakage via an index.php?mod=mobile&name=member&do=index request...

CVE-2018-10219

CVE-2018-10219 affects baijiacms V3 and describes a physical path leakage exploitation via the request index.php?mod=mobile&name=member&do=index. Public sources (CNVD-2018-11709, NVD entry) attribute an information disclosure vulnerability to this path leakage, with the impact on confidentiality ...

CVE-2018-10225

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

CVE-2018-10225

The thinkphp PHP-based web application development framework version 3.1.3 is vulnerable to SQL Injection . A remote attacker can exploit this by sending a specially crafted SQL statement via the index.php s parameter. Successful exploitation allows the attacker to view, add, change, or delete in...

CVE-2018-10225: Improper Neutralization of Special Elements used in an SQL Command

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

CVE-2018-10221: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WUZHI CMS V4.1.0. There is a persistent XSS vulnerability that can steal the administrator cookies via the tagtag parameter to the index.php?m=tags&f=index&v=add&&su=wuzhicms URI. After a website editor whose privilege is lower than the administrator logs in, he can add...

CVE-2018-10219: Exposure of Sensitive Information to an Unauthorized Actor

baijiacms V3 has physical path leakage via an index.php?mod=mobile&name=member&do=index request...

PT-2018-9766

Name of the Vulnerable Software and Affected Versions: YzmCMS version 3.8 Description: A CSRF issue allows adding a tag via the "/index.php/admin/tag/add.html" API endpoint. Recommendations: For YzmCMS version 3.8, consider implementing CSRF protection measures to prevent unauthorized actions, su...

CVE-2018-10224: Cross-Site Request Forgery (CSRF)

An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html...

PT-2018-9765

Name of the Vulnerable Software and Affected Versions: YzmCMS version 3.8 Description: An issue was discovered that allows for a CSRF vulnerability, enabling the addition of an admin account via the "/index.php/admin/admin manage/add.html" API endpoint. Recommendations: For YzmCMS version 3.8,...

PT-2018-9761

Name of the Vulnerable Software and Affected Versions: baijiacms version V3 Description: The issue is related to physical path leakage. This can occur via a specific request to 'index.php?mod=mobile&name=member&do=index'. Recommendations: For baijiacms version V3, consider restricting access to t...

PT-2018-9767

Name of the Vulnerable Software and Affected Versions: thinkphp version 3.1.3 Description: The issue is related to SQL Injection, which can be exploited via the s parameter in the "index.php" endpoint. Recommendations: For thinkphp version 3.1.3, update to a newer version that contains a fix for...