CVE-2018-5696: Improper Neutralization of Special Elements used in an SQL Command

The iJoomla comadagency plugin 6.0.9 for Joomla! allows SQL injection via the advertiserstatus and statusselect parameters to index.php...

Design/Logic Flaw

Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via the archiver\index.php action parameter...

CVE-2018-5377

Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via the archiver\index.php action parameter...

PT-2018-16933

Name of the Vulnerable Software and Affected Versions DiscuzX version X3.4 Description The issue allows remote attackers to bypass intended access restrictions. This is achieved via the action parameter in the "archiver/index.php" endpoint. Recommendations For DiscuzX version X3.4, consider...

CVE-2018-5377: Missing Authorization

Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via the archiver\index.php action parameter...

CVE-2017-16514

Multiple persistent stored Cross-Site-Scripting XSS vulnerabilities in the files /wb/admin/admintools/tool.php Droplet Description and /install/index.php Site Title in WebsiteBaker 2.10.0 allow attackers to insert persistent JavaScript code that gets reflected back to users in multiple areas in t...

PT-2018-6283

Name of the Vulnerable Software and Affected Versions: WebsiteBaker version 2.10.0 Description: The issue concerns multiple persistent stored Cross-Site-Scripting XSS vulnerabilities. These vulnerabilities are located in the files /wb/admin/admintools/tool.php, related to the Droplet Description,...

CVE-2017-16514: Improper Neutralization of Input During Web Page Generation

Multiple persistent stored Cross-Site-Scripting XSS vulnerabilities in the files /wb/admin/admintools/tool.php Droplet Description and /install/index.php Site Title in WebsiteBaker 2.10.0 allow attackers to insert persistent JavaScript code that gets reflected back to users in multiple areas in t...

CVE-2018-5249

Cross-site scripting XSS vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field aka the login parameter to the bancanLogin function in index.php...

CVE-2018-5249

Shaarli contains a Cross-site scripting (XSS) vulnerability in versions prior to 0.8.5 and 0.9.x prior to 0.9.3. An attacker can inject arbitrary code via the login form’s username field (the ban_canLogin parameter in index.php). The issue is addressed in Shaarli v0.9.3 and v0.8.5 releases refere...

CVE-2018-5249

Cross-site scripting XSS vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field aka the login parameter to the bancanLogin function in index.php...

PT-2018-16838

Name of the Vulnerable Software and Affected Versions Shaarli versions prior to 0.8.5 Shaarli versions 0.9.x prior to 0.9.3 Description The issue allows remote attackers to inject arbitrary code via the login form's username field, which is passed to the ban canLogin function in index.php. This...

CVE-2018-5249: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Shaarli before 0.8.5 and 0.9.x before 0.9.3 allows remote attackers to inject arbitrary code via the login form's username field aka the login parameter to the bancanLogin function in index.php...

Server side request forgery (ssrf)

Biometric Shift Employee Management System has XSS via the LastName parameter in an index.php?user=ajax request...

Cross site request forgery (csrf)

Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=additiondeduction request...

CVE-2017-17989

Biometric Shift Employee Management System has XSS via the index.php holidayname parameter in an editholiday action...

CVE-2017-17992

Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php formfilename parameter in a downloadform action...

CVE-2017-17995

Biometric Shift Employee Management System has XSS via the LastName parameter in an index.php?user=ajax request...

CVE-2017-17990

Biometric Shift Employee Management System has CSRF via index.php in an editholiday action...

CVE-2017-17989

The vulnerability described for CVE-2017-17989 affects the Biometric Shift Employee Management System. The issue is a Cross-Site Scripting (XSS) flaw that can be triggered via the index.php holiday_name parameter in the edit_holiday action. According to the available data, this is the scope, with...