CVE-2018-9307: Improper Neutralization of Input During Web Page Generation

dsmall v20180320 allows XSS via the pdrsn parameter to public/index.php/home/predeposit/index.html...

rhemuthcastle.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-595040 Description| Value ---|--- Affected Website:| rhemuthcastle.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

CVE-2018-7196

Cross-site scripting XSS vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter...

CVE-2018-7196: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in /scp/index.php in Enhancesoft osTicket before 1.10.2 allows remote attackers to inject arbitrary web script or HTML via the "sort" parameter...

PT-2018-17942

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.10.2 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the sort parameter in the "/scp/index.php" API endpoint. Recommendations For versions prior to...

CVE-2014-2293

Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection attacks and delete arbitrary files or execute arbitrary PHP code via crafted serialized data in the 1 authenticationmethodser or 2 authenticationinfoser parameter to index.php, or 3...

CVE-2014-2293: Improper Control of Generation of Code

Zikula Application Framework before 1.3.7 build 11 allows remote attackers to conduct PHP object injection attacks and delete arbitrary files or execute arbitrary PHP code via crafted serialized data in the 1 authenticationmethodser or 2 authenticationinfoser parameter to index.php, or 3...

PT-2018-4194

Name of the Vulnerable Software and Affected Versions Zikula Application Framework versions prior to 1.3.7 build 11 Description The issue allows remote attackers to conduct PHP object injection attacks, potentially leading to the deletion of arbitrary files or the execution of arbitrary PHP code...

CVE-2018-9014

dsmall v20180320 allows physical path leakage via a public/index.php/home/predeposit/index.html?pdrsn= request...

Cross site request forgery (csrf)

dsmall v20180320 allows physical path leakage via a public/index.php/home/predeposit/index.html?pdrsn= request...

CVE-2018-9016

dsmall v20180320 allows XSS via the main page search box at the public/index.php/home URI...

CVE-2018-9016

dsmall v20180320 allows XSS via the main page search box at the public/index.php/home URI...

CVE-2018-9016

The CVE-2018-9016 entry corresponds to a cross‑site scripting (XSS) vulnerability in dsmall v20180320, exploitable via the main page search box (public/index.php/home). The CNVD entry explicitly notes that a remote attacker can inject arbitrary HTML/JavaScript to obtain sensitive information. The...

PT-2018-18783

Name of the Vulnerable Software and Affected Versions dsmall version 20180320 Description The issue allows for XSS via the member search box at the "public/index.php/home/membersnsfriend/findlist.html" URI. Recommendations For version 20180320, consider restricting access to the member search box...

CVE-2018-9017: Improper Neutralization of Input During Web Page Generation

dsmall v20180320 allows XSS via the member search box at the public/index.php/home/membersnsfriend/findlist.html URI...

PT-2018-18782

Name of the Vulnerable Software and Affected Versions dsmall version 20180320 Description The issue allows for XSS via the main page search box at the "public/index.php/home" URI. Recommendations For version 20180320, avoid using the search box in the main page until a fix is available. As a...

PT-2018-18780

Name of the Vulnerable Software and Affected Versions dsmall version v20180320 Description The issue allows physical path leakage via a /public/index.php/home/predeposit/index.html?pdr sn= request. Recommendations For dsmall version v20180320, avoid using the pdr sn variable in the...

CVE-2018-9016: Improper Neutralization of Input During Web Page Generation

dsmall v20180320 allows XSS via the main page search box at the public/index.php/home URI...

CVE-2018-9015: Improper Neutralization of Input During Web Page Generation

dsmall v20180320 allows XSS via the public/index.php/home/predeposit/index.html pdrsn parameter aka the CMS search box...

CVE-2018-9014: Exposure of Sensitive Information to an Unauthorized Actor

dsmall v20180320 allows physical path leakage via a public/index.php/home/predeposit/index.html?pdrsn= request...