CVE-2020-18418: Cross-Site Request Forgery (CSRF)

A Cross site request forgery CSRF vulnerability was discovered in FeiFeiCMS v4.1.190209, which allows attackers to create administrator accounts via /index.php?s=Admin-Admin-Insert...

CVE-2023-33750

A stored cross-site scripting XSS vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description parameter at /index.php?s=/article/ApiAdminArticle/itemAdd...

CVE-2020-19263: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF in MipCMS v5.0.1 allows attackers to arbitrarily escalate user privileges to administrator via index.php?s=/user/ApiAdminUser/itemEdit...

CVE-2020-17563: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to " /index.php?s=/admin-tpl-del&id="...

CVE-2019-16310: Improper Neutralization of Input During Web Page Generation

NIUSHOP V1.11 has XSS via the index.php?s=/admin URI...

CVE-2019-9825: Unrestricted Upload of File with Dangerous Type

FeiFeiCMS 4.1.190209 allows remote attackers to upload and execute arbitrary PHP code by visiting index.php?s=Admin-Index to modify the set of allowable file extensions, as demonstrated by adding php to the default jpg,gif,png,jpeg setting, and then using the "add article" feature...

PT-2018-15236

Name of the Vulnerable Software and Affected Versions PHPCMF version 4.1.3 Description The issue is related to a security problem where an attacker can inject malicious code. The problem occurs via the first input field to the "index.php?s=member&c=register&m=index" URI, allowing for malicious co...

CVE-2018-19621: Cross-Site Request Forgery (CSRF)

server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team...

PT-2018-15023

Name of the Vulnerable Software and Affected Versions ShowDoc version 2.4.2 Description The issue allows for a CSRF attack, which can be used to add members to a team. The affected endpoint is "server/index.php?s=/api/teamMember/save". This can potentially lead to unauthorized modifications to te...

CVE-2018-15177: Cross-Site Request Forgery (CSRF)

In Gxlcms 2.0, a news/index.php?s=Admin-Admin-Insert CSRF attack can add an administrator account...

CVE-2018-14685: Exposure of Sensitive Information to an Unauthorized Actor

The add function in www/Lib/Lib/Action/Admin/TplAction.class.php in Gxlcms v1.1.4 allows remote attackers to read arbitrary files via a crafted index.php?s=Admin-Tpl-ADD-id request, related to Lib/Common/Admin/function.php...

CVE-2018-12971: Cross-Site Request Forgery (CSRF)

EasyCMS 1.3 has CSRF via the index.php?s=/admin/user/delAll URI to delete users...

Sql injection

Creative Management System CMS Lite 1.4 allows SQL Injection via the S parameter to index.php...

Design/Logic Flaw

Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg...