CVE-2018-10183

An issue was discovered in BigTree 4.2.22. There is cross-site scripting XSS in /core/inc/lib/less.php/test/index.php because of a $SERVER'REQUESTURI' echo, as demonstrated by the dir parameter in a file=charsets action...

CVE-2018-10183: Improper Neutralization of Input During Web Page Generation

An issue was discovered in BigTree 4.2.22. There is cross-site scripting XSS in /core/inc/lib/less.php/test/index.php because of a $SERVER'REQUESTURI' echo, as demonstrated by the dir parameter in a file=charsets action...

PT-2018-9736

Name of the Vulnerable Software and Affected Versions: BigTree version 4.2.22 Description: The issue is related to cross-site scripting XSS in the /core/inc/lib/less.php/test/index.php file. This occurs due to the echo of the $ SERVER'REQUEST URI' variable. The vulnerability can be demonstrated b...

CVE-2018-10128

An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php...

Design/Logic Flaw

An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php...

Code injection

PbootCMS v0.9.8 allows PHP code injection via an IF label in index.php/About/6.html or admin.php/Site/index.html, related to the parserIfLabel function in \apps\home\controller\ParserController.php...

CVE-2018-10128

An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php...

CVE-2018-10128

An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php...

CVE-2018-10128

XYHCMS 3.5 is affected by a Cross-Site Scripting (XSS) vulnerability via the test parameter to index.php. Multiple sources (CNVD-2018-07980, RH:CVE-2018-10128, NVD/CVE-2018-10128, OSV, CNVD) describe an XSS that can execute JavaScript and is exploitable through the index.php?test parameter. The r...

Cross site scripting

Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php...

CVE-2018-10128: Improper Neutralization of Input During Web Page Generation

An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php...

CVE-2018-10133: Improper Control of Generation of Code

PbootCMS v0.9.8 allows PHP code injection via an IF label in index.php/About/6.html or admin.php/Site/index.html, related to the parserIfLabel function in \apps\home\controller\ParserController.php...

PT-2018-9699

Name of the Vulnerable Software and Affected Versions: XYHCMS version 3.5 Description: An issue was discovered that allows XSS via the test parameter to the "index.php" endpoint. Recommendations: For XYHCMS version 3.5, consider restricting access to the test parameter in the "index.php" endpoint...

PT-2018-9701

Name of the Vulnerable Software and Affected Versions: PbootCMS version 0.9.8 Description: The issue allows PHP code injection via an IF label in specific endpoints, such as "index.php/About/6.html" or "admin.php/Site/index.html". This is related to the parserIfLabel function in the...

CVE-2018-10127: Cross-Site Request Forgery (CSRF)

An issue was discovered in XYHCMS 3.5. It has CSRF via an index.php?g=Manage&m=Rbac&a=addUser request, resulting in addition of an account with the administrator role...

PT-2018-9698

Name of the Vulnerable Software and Affected Versions: XYHCMS version 3.5 Description: An issue was discovered that allows CSRF via an "index.php?g=Manage&m=Rbac&a=addUser" request, resulting in the addition of an account with the administrator role. Recommendations: For XYHCMS version 3.5,...

CVE-2018-10118

Monstra CMS 3.0.4 is affected by a Stored XSS in the Name field on the Create New Page screen (admin/index.php?id=pages), related to plugins/box/pages/pages.admin.php. This CVE details the vulnerable component path and the input point that leads to script execution. The connected data confirms th...

CVE-2018-10118

Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php...

CVE-2018-10118: Improper Neutralization of Input During Web Page Generation

Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php...

PT-2018-9692

Name of the Vulnerable Software and Affected Versions: Monstra CMS version 3.0.4 Description: The issue is related to a Stored XSS in the Name field on the Create New Page screen, accessible under the "admin/index.php?id=pages" URI, and is associated with the plugins/box/pages/pages.admin.php fil...