108 matches found
CVE-2018-17831: Improper Neutralization of Special Elements used in an SQL Command
In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rexlist class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rexlist were used...
PT-2018-14211
Name of the Vulnerable Software and Affected Versions REDAXO versions prior to 5.6.3 Description A critical SQL injection issue has been found in the rex list class due to the prepareQuery function in core/lib/list.php. This can be exploited via the "sort" parameter in the...
CVE-2018-15679
An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php?page=forums&action=search is vulnerable to reflected cross-site scripting...
PT-2018-13135
Name of the Vulnerable Software and Affected Versions BTITeam XBTIT version 2.5.4 Description The issue concerns a stored XSS exploit via the title of a news item in the newsfeed, accessible through the API endpoint "/index.php?page=viewnews". This exploit is also possible through CSRF...
PT-2018-13136
Name of the Vulnerable Software and Affected Versions BTITeam XBTIT version 2.5.4 Description An issue was discovered in the sign-up page available at /index.php?page=signup, where the act parameter is vulnerable to reflected cross-site scripting. Recommendations For version 2.5.4, consider...
CVE-2018-15678: Improper Neutralization of Input During Web Page Generation
An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting...
CVE-2018-15679: Improper Neutralization of Input During Web Page Generation
An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php?page=forums&action=search is vulnerable to reflected cross-site scripting...
PT-2018-13240
Name of the Vulnerable Software and Affected Versions REDAXO CMS version 4.7.2 Description An issue was discovered that allows for a CSRF vulnerability, enabling the addition of an administrator account via the "index.php?page=user" endpoint. The page and user parameters are involved in this issu...
CVE-2018-15850: Cross-Site Request Forgery (CSRF)
An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an administrator account via index.php?page=user...
vehiculesutilitairesmag.com XSS vulnerability
Open Bug Bounty ID: OBB-625745 Description| Value ---|--- Affected Website:| vehiculesutilitairesmag.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
PT-2018-9667
Name of the Vulnerable Software and Affected Versions: CMS Made Simple CMSMS versions prior to 2.2.8 Description: The issue allows physical path leakage through various means, including an invalid page value in the /index.php?page= parameter, a crafted URI starting with /index.php?mact=Search, or...
CVE-2018-10082: Exposure of Sensitive Information to an Unauthorized Actor
CMS Made Simple CMSMS through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or...
mktx.az XSS vulnerability
Vulnerable URL: http://mktx.az/index.php?page=archivenews=5" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP website status:| No Check mktx.az SSL...
preCMS 1 - (index.php page) Remote SQL injection Vulnerability
No description provided by source. Viva IslaM Viva IslaM Remote SQL injection Vulnerability preCMS v.1 index.php page AuTh0r : Mr.SQL H0ME : WwW.PaL-HaCkEr.CoM & WwW.AtsDp.CoM/f Email : [email protected] SYRIAN Arab HACkErS -: Exploite :-...
Scribe <= 0.2 (index.php page) Local File Inclusion Vulnerability
No description provided by source. scribe 0.2 local file inclusion vulnerability download http://sourceforge.net/projects/scribe/ author muuratsalo contact muuratsaloatgmail.com exploit http://localhost/0.2/index.php?page=../../../../../../../../../../etc/passwd%00 milw0rm.com 2008-02-14...
WSN Guest 1.02 - orderlinks SQL Injection
WSN Guest 1.02 - orderlinks SQL Injection Author : Gamoscu Homepage : http://www.1923turk.com Blog : http://gamoscu.wordpress.com/ Script : WSN Guest 1.02 Download : http://scripts.webmastersite.net/wsnguest/wsnguest.zip Exploat :index.php?page=20&orderlinks=SQL...
YAP 1.1.1 - index.php Local File Inclusion
YAP 1.1.1 - index.php Local File Inclusion YAP v1.1.1 Local File Inclusion Vulnerability AUTHOR : Alkindiii CONTACT : Alkindiii 4T islamway D0T net HOME : http://www.soqor.net Script : YAP Version : 1.1.1 Download v1.1 : http://wildmary.net-sauvage.com/share/yap1.1.tar.gz Update to v1.1.1 :...
Unfixed XSS vulnerability at www.kentaurus.cz
Security researcher austinator, has submitted on 15/08/2008 a cross-site-scripting XSS vulnerability affecting www.kentaurus.cz, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 16/08/2008. It is currentl...
syzygyCMS 0.3 (index.php page) Local File Inclusion Vulnerability
Exploit for unknown platform in category web applications ================================================================= syzygyCMS 0.3 index.php page Local File Inclusion Vulnerability ================================================================= + syzygyCMS 0.3 Local File Inclusion +...