PT-2022-16719

Name of the Vulnerable Software and Affected Versions Genixcms version 1.1.11 Description A stored Cross-Site Scripting XSS issue exists in the /gxadmin/index.php?page=themes&view=options endpoint via the intro title and intro image parameters. This allows for malicious script execution...

CVE-2022-24563: Improper Neutralization of Input During Web Page Generation

In Genixcms v1.1.11, a stored Cross-Site Scripting XSS vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the introtitle and introimage parameters...

CVE-2021-46360: Unrestricted Upload of File with Dangerous Type

Authenticated remote code execution RCE in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell through /adminzone/index.php?page=admin-commandr...

CVE-2021-46360

Authenticated remote code execution RCE in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell through /adminzone/index.php?page=admin-commandr...

CVE-2020-28129: Improper Neutralization of Input During Web Page Generation

Stored Cross-site scripting XSS vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php?page=packages via vulnerable fields 'Package Name' and 'Description'...

PT-2020-16879

Name of the Vulnerable Software and Affected Versions SourceCodester Car Rental Management System version 1.0 Description The issue allows remote code execution due to an arbitrary file upload vulnerability in the Upload Image component. This is possible because .php files can be uploaded to the...

CVE-2020-27956: Unrestricted Upload of File with Dangerous Type

An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the user to conduct remote code execution via admin/index.php?page=managecar because .php files can be uploaded to admin/assets/uploads/ under the web root...

CVE-2020-25515: Unrestricted Upload of File with Dangerous Type

Sourcecodester Simple Library Management System 1.0 is affected by Insecure Permissions via Books New Book , http:// /lms/index.php?page=books...

PT-2020-12683

Name of the Vulnerable Software and Affected Versions Search Meter plugin versions through 2.13.2 Description The issue allows user input introduced in the search bar to be any formula, potentially leading to remote code execution via CSV injection if a specific export is performed, specifically...

CVE-2020-5842: Improper Neutralization of Input During Web Page Generation

Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI. The payload is, for example, executed on the admin/index.php?page=users/manage page...

PT-2020-18751

Name of the Vulnerable Software and Affected Versions Codoforum version 4.8.3 Description The issue allows for XSS in the user registration page, specifically through the username field when accessing the "index.php?u=/user/register" API endpoint. The payload can be executed on the...

CVE-2019-14928

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A number of stored cross-site script XSS vulnerabilities allow an attacker to inject malicious code directly into the application. An example input variable vulnerable to...

PT-2019-15182

Name of the Vulnerable Software and Affected Versions Hotaru CMS version 1.7.2 Description A stored XSS issue was found in the admin index.php?page=settings SITE NAME field, allowing for potential exploitation. Recommendations For Hotaru CMS version 1.7.2, update to a newer version that contains ...

PT-2019-7547

Name of the Vulnerable Software and Affected Versions osClass version 3.6.1 Description The issue allows for directory traversal via the plugin parameter, which can be exploited for remote PHP code execution. An administrator can upload an image containing PHP code in the EXIF data through the...

CVE-2018-1000848

Wampserver version prior to version 3.1.5 contains a Cross Site Scripting XSS vulnerability in index.php localhost page that can result in very low. This attack appear to be exploitable via payload onmouseover. This vulnerability appears to have been fixed in 3.1.5 and later...

CVE-2018-18198: Improper Neutralization of Input During Web Page Generation

The $openerinputfield variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=XSS request...

PT-2018-14360

Name of the Vulnerable Software and Affected Versions REDAXO version 5.6.3 Description The issue concerns the $opener input field variable in the addons/mediapool/pages/index.php file, which is not properly filtered and is directly output to the page. An attacker can exploit this by inserting XSS...

CVE-2018-17831

In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rexlist class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rexlist were used...

PT-2018-14211

Name of the Vulnerable Software and Affected Versions REDAXO versions prior to 5.6.3 Description A critical SQL injection issue has been found in the rex list class due to the prepareQuery function in core/lib/list.php. This can be exploited via the "sort" parameter in the...

PT-2018-14210

Name of the Vulnerable Software and Affected Versions REDAXO version 5.6.2 Description The issue concerns the $args variable in the addons/mediapool/pages/index.php file, where names are not restricted, allowing an attacker to insert XSS payloads. This can be achieved via the...