57 matches found
CVE-2020-19511
Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1 className and !2 Description fields in index.php/Admin/Classes,...
Cross site scripting
Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1 className and !2 Description fields in index.php/Admin/Classes,...
CVE-2020-19511
CVE-2020-19511 affects Typesetter 5.1. The vulnerability is a cross-site scripting (XSS) flaw exploitable via the index.php/Admin/Classes interface, specifically through the className and Description fields. Descriptions across multiple connected sources confirm the editable fields in the admin U...
CVE-2020-19511
Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1 className and !2 Description fields in index.php/Admin/Classes,...
CVE-2020-19511: Improper Neutralization of Input During Web Page Generation
Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1 className and !2 Description fields in index.php/Admin/Classes,...
CVE-2020-26669: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability was discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to site/index.php/admin/pages/update...
CVE-2020-23376: Cross-Site Request Forgery (CSRF)
NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parameter to launch a stored XSS attack...
PT-2020-6081
Name of the Vulnerable Software and Affected Versions BigTree CMS versions 4.4.10 and earlier Description A stored cross-site scripting XSS vulnerability was discovered in BigTree CMS, which allows an authenticated attacker to execute arbitrary web scripts or HTML via the page content to...
CVE-2019-17431
An issue was discovered in fastadmin 1.0.0.20190705beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerability...
CVE-2019-17431: Cross-Site Request Forgery (CSRF)
An issue was discovered in fastadmin 1.0.0.20190705beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerability...
CVE-2019-17046: Unrestricted Upload of File with Dangerous Type
Ilch 2.1.22 allows remote code execution because php is listed under "Allowed files" on the index.php/admin/media/settings/index page...
CVE-2019-16721: Cross-Site Request Forgery (CSRF)
NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user...
CVE-2019-13370: Cross-Site Request Forgery (CSRF)
index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator...
CVE-2018-16626
CVE-2018-16626 affects Typesetter 5.1: index.php/Admin/Classes allows cross-site scripting via the description of a new class name. The vulnerability is an XSS in the class-creation workflow, arising from how the description field is processed in Admin/Classes. Public references in the connected ...
CVE-2018-16625: Improper Neutralization of Input During Web Page Generation
index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...
CVE-2018-16639: Improper Neutralization of Input During Web Page Generation
Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation...
CVE-2018-16626: Improper Neutralization of Input During Web Page Generation
index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name...
CVE-2018-20837: Improper Neutralization of Input During Web Page Generation
include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS...