CVE-2018-7474

An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php...

PT-2018-18090

Name of the Vulnerable Software and Affected Versions Textpattern CMS versions 4.6.2 and earlier Description An issue allows SQL code injection in the qty variable on the "index.php" page. Recommendations For Textpattern CMS versions 4.6.2 and earlier, update to a version later than 4.6.2 to...

CVE-2018-7474: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php...

www2.produktinfo.conrad.de XSS vulnerability

Open Bug Bounty ID: OBB-579604 Description| Value ---|--- Affected Website:| www2.produktinfo.conrad.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

TextPattern 4.6.2 - qty SQL Injection Vulnerability

Exploit for php platform in category web applications ============================================= MGC ALERT 2018-002 - Original release date: February 12, 2018 - Last revised: March 12, 2018 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score - CVE-ID: CVE-2018-7474...

Design/Logic Flaw

Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via an invalid channelname parameter to /index.php?/manage/channel/addchannel or a direct request to /export.php...

CVE-2018-8056

Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via an invalid channelname parameter to /index.php?/manage/channel/addchannel or a direct request to /export.php...

CVE-2018-8056: Exposure of Sensitive Information to an Unauthorized Actor

Physical path Leakage exists in Western Bridge Cobub Razor 0.8.0 via an invalid channelname parameter to /index.php?/manage/channel/addchannel or a direct request to /export.php...

PT-2018-18408

Name of the Vulnerable Software and Affected Versions: Western Bridge Cobub Razor version 0.8.0 Description: A physical path leakage issue exists due to an invalid channel name parameter. This can be exploited via a request to /index.php?/manage/channel/addchannel or a direct request to...

PT-2018-18409

Name of the Vulnerable Software and Affected Versions: Western Bridge Cobub Razor version 0.8.0 Description: A SQL Injection issue exists, related to the channel name or platform parameter in a "/index.php?/manage/channel/addchannel" request. This is connected to the...

PT-2018-18252

Name of the Vulnerable Software and Affected Versions: Western Bridge Cobub Razor version 0.7.2 Description: An issue was discovered where authentication is not required for the "/index.php?/install/installation/createuserinfo" API endpoint, resulting in the ability to create accounts without...

PT-2018-18235

Name of the Vulnerable Software and Affected Versions: MetInfo version 6.0.0 Description: A Cross Site Scripting XSS issue exists due to mishandled input data in the /feedback/index.php endpoint, specifically within the app/system/feedback/web/feedback.class.php file. Recommendations: For MetInfo...

PT-2018-18234

Name of the Vulnerable Software and Affected Versions: Western Bridge Cobub Razor version 0.7.2 Description: A cross-site request forgery issue exists, allowing for account creation via the "/index.php?/user/createNewUser/" endpoint. Recommendations: For version 0.7.2, consider restricting access...

CVE-2018-7721: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS exists in MetInfo 6.0.0 via /feedback/index.php because app/system/feedback/web/feedback.class.php mishandles input data...

CVE-2018-7720: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability exists in Western Bridge Cobub Razor 0.7.2 via /index.php?/user/createNewUser/, resulting in account creation...

PT-2018-18244

Name of the Vulnerable Software and Affected Versions: YxtCMF version 3.1 Description: An issue was discovered in YxtCMF, where the RbacController.class.php file is vulnerable to CSRF attacks. This allows an attacker to modify an administrator account via the "index.php/admin/user/add post.html"...

CVE-2018-7733: Cross-Site Request Forgery (CSRF)

An issue was discovered in YxtCMF 3.1. RbacController.class.php has CSRF, as demonstrated by modifying an administrator account via index.php/admin/user/addpost.html...

CVE-2018-7653

In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter...

CVE-2018-7653

In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter...

PT-2018-18187

Name of the Vulnerable Software and Affected Versions YzmCMS version 3.6 Description The issue is related to an XSS vulnerability. It affects the index.php file through the a, c, or m parameters. Recommendations For YzmCMS version 3.6, consider restricting access to the vulnerable parameters a, c...