PT-2018-18187

Name of the Vulnerable Software and Affected Versions YzmCMS version 3.6 Description The issue is related to an XSS vulnerability. It affects the index.php file through the a, c, or m parameters. Recommendations For YzmCMS version 3.6, consider restricting access to the vulnerable parameters a, c...

CVE-2018-7653: Improper Neutralization of Input During Web Page Generation

In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter...

rus.log.ee XSS vulnerability

Open Bug Bounty ID: OBB-573134 Description| Value ---|--- Affected Website:| rus.log.ee Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

meditox.eu XSS vulnerability

Open Bug Bounty ID: OBB-572639 Description| Value ---|--- Affected Website:| meditox.eu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Design/Logic Flaw

Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to list/backup/index.php...

CVE-2015-4117

Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to list/backup/index.php...

PT-2018-4375

Name of the Vulnerable Software and Affected Versions Vesta Control Panel versions prior to 0.9.8-14 Description The issue allows remote authenticated users to execute arbitrary commands. This is achieved by using shell metacharacters in the backup parameter to the "/list/backup/index.php" API...

CVE-2018-7172

In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal...

CVE-2018-7172

In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal...

PT-2018-17928

Name of the Vulnerable Software and Affected Versions WonderCMS versions prior to 2.4.1 Description The issue allows remote attackers to delete arbitrary files via directory traversal in the index.php file. Recommendations For versions prior to 2.4.1, update to version 2.4.1 or later to resolve t...

CVE-2018-7172: Improper Limitation of a Pathname to a Restricted Directory

In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal...

nutten69.com XSS vulnerability

Open Bug Bounty ID: OBB-568923 Description| Value ---|--- Affected Website:| nutten69.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

PT-2018-18077

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.1.6 Description A remote code execution issue exists, allowing attackers to inject arbitrary PHP code via the timezone parameter in step 4 of a fresh installation procedure, specifically in the...

CVE-2018-7448: Improper Neutralization of Special Elements used in an OS Command

Remote code execution vulnerability in /cmsms-2.1.6-install.php/index.php in CMS Made Simple version 2.1.6 allows remote attackers to inject arbitrary PHP code via the "timezone" parameter in step 4 of a fresh installation procedure...

shogi.net XSS vulnerability

Open Bug Bounty ID: OBB-565102 Description| Value ---|--- Affected Website:| shogi.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Cross site request forgery (csrf)

application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...

CVE-2018-7219

application/admin/controller/Admin.php in NoneCms 1.3.0 has CSRF, as demonstrated by changing an admin password or adding an account via a public/index.php/admin/admin/edit.html request...

PT-2018-17958

Name of the Vulnerable Software and Affected Versions NoneCms version 1.3.0 Description The issue allows for CSRF attacks, which can be used to perform actions such as changing an admin password or adding an account. This can be achieved by sending a request to the...

PT-2018-6329

Name of the Vulnerable Software and Affected Versions: Userscape HelpSpot versions prior to 4.7.2 Description: A reflected cross-site scripting issue exists in the "return" parameter of the "index.php?pg=moderated" API endpoint. It executes when the return link is clicked. Recommendations: For...

CVE-2017-16756: Cross-Site Request Forgery (CSRF)

An issue was discovered in Userscape HelpSpot before 4.7.2. A cross-site request forgery vulnerability exists on POST requests to the "index.php?pg=password.change" endpoint. This allows an attacker to change the password of another user's HelpSpot account...