13426 matches found
CVE-2017-7402
Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg...
PT-2017-17711
Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows remote authenticated users to upload and execute arbitrary PHP code. This is achieved by sending a POST request to the "admin/index.php?s=publish&x=filemanager" endpoint with a filename that has...
CVE-2017-7402: Improper Control of Generation of Code
Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg...
CVE-2017-7361
Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack...
Design/Logic Flaw
Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack...
Design/Logic Flaw
Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack...
CVE-2017-7363
Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack...
CVE-2017-7363
Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack...
CVE-2017-7359
Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack...
CVE-2017-7361
Pixie 1.0.4 is affected by a cross-site scripting (XSS) vulnerability exposed via admin/index.php s=publish&m=static&x=. The CNVD entry states Pixie 1.0.4 contains a cross-site scripting flaw due to improper validation of user-submitted input, allowing a remote attacker to inject arbitrary web sc...
CVE-2017-7359
Pixie 1.0.4 contains a cross-site scripting (XSS) vulnerability in the CMS, described as an XSS in Pixie 1.0.4 via admin/index.php s=login&m=. Root cause: improper input validation/handling. Impact per sources indicates potential script injection; exploitation status is not provided in the docume...
CVE-2017-7360
CVE-2017-7360 affects Pixie 1.0.4. The connected documents identify a cross-site scripting vulnerability in the admin interface, specifically in the admin/index.php s=settings&x= parameter, indicating insufficient input validation in the settings handling path. The impact is an XSS where an attac...
PT-2017-17686
Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows for an XSS attack. The attack can be performed through the admin/index.php endpoint with specific parameters set, such as s=publish, m=module, and x. Recommendations For Pixie version 1.0.4, as ...
PT-2017-17683
Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows for an XSS attack through the admin/index.php endpoint with specific settings. The attack is facilitated by the s and x parameters. Recommendations For Pixie version 1.0.4, as a temporary...
PT-2017-17682
Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows for an XSS attack through the admin/index.php page, specifically targeting the s=login&m= parameters. Recommendations For Pixie version 1.0.4, as a temporary workaround, consider restricting...
PT-2017-17684
Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows for an XSS attack. The attack can be performed through the "s=publish&m=static&x=" parameter in the admin/index.php endpoint. Recommendations For Pixie version 1.0.4, update to a version that...
PT-2017-17685
Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows for an XSS attack. The attack can be performed through the "s=publish&m=dynamic&x=" parameter in the admin/index.php endpoint. Recommendations For Pixie version 1.0.4, update to a version that...
CVE-2017-7360: Improper Neutralization of Input During Web Page Generation
Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack...