7216 matches found
CVE-2018-10503
An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...
CVE-2018-10374
EasyCMS 1.3 is affected by a Cross‑Site Scripting (XSS) vulnerability in the s POST parameter (the value of the search box) sent to index.php?s=/index/search/index.html. The issue arises from XSS in that parameter, enabling injection of arbitrary script/HTML. This CVE entry corresponds to EasyCMS...
CVE-2018-10311
A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the tagpinyin parameter to the /index.php?m=tags&f=index&v=add URI...
Cross site request forgery (csrf)
index.php?m=member&v=pwreset in WUZHI CMS 4.1.0 allows CSRF to change the password of a common member...
Cross site scripting
A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the tagpinyin parameter to the /index.php?m=tags&f=index&v=add URI...
Cross site request forgery (csrf)
An issue was discovered in HongCMS v3.0.0. There is a CSRF vulnerability that can add an administrator account via the admin/index.php/users/save URI...
johnleary.com XSS vulnerability
Open Bug Bounty ID: OBB-606065 Description| Value ---|--- Affected Website:| johnleary.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2018-10267
WTCMS 1.0 is affected by a CSRF vulnerability that allows an attacker to add an administrator account using the URI index.php?admin&m=user&a=add_post. Root cause: CSRF in the admin-user creation flow. Impact: attacker could elevate privileges by creating an admin account; no exploitation details ...
CVE-2018-10248
An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can delete any article via index.php?m=content&f=content&v=recycledelete...
Sql injection
thinkphp 3.1.3 has SQL Injection via the index.php s parameter...
CVE-2018-10225
thinkphp 3.1.3 has SQL Injection via the index.php s parameter...
CVE-2018-10219
baijiacms V3 has physical path leakage via an index.php?mod=mobile&name=member&do=index request...
CVE-2018-10221
An issue was discovered in WUZHI CMS V4.1.0. There is a persistent XSS vulnerability that can steal the administrator cookies via the tagtag parameter to the index.php?m=tags&f=index&v=add&&su=wuzhicms URI. After a website editor whose privilege is lower than the administrator logs in, he can add...
CVE-2018-10225
thinkphp 3.1.3 has SQL Injection via the index.php s parameter...
CVE-2018-10225
thinkphp 3.1.3 has SQL Injection via the index.php s parameter...
CVE-2018-10219
baijiacms V3 has physical path leakage via an index.php?mod=mobile&name=member&do=index request...
CVE-2018-10225
CVE-2018-10225 affects thinkphp 3.1.3. The vulnerability is a SQL injection via the index.php?s parameter, enabling crafted SQL statements to affect the backend database. Exploitation details are not provided in the connected documents; the CVSS info from NVD indicates CRITICAL impact (AV:N/AC:L/...
CVE-2018-10219
CVE-2018-10219 affects baijiacms V3 and describes a physical path leakage exploitation via the request index.php?mod=mobile&name=member&do=index. Public sources (CNVD-2018-11709, NVD entry) attribute an information disclosure vulnerability to this path leakage, with the impact on confidentiality ...
Code injection
PbootCMS v0.9.8 allows PHP code injection via an IF label in index.php/About/6.html or admin.php/Site/index.html, related to the parserIfLabel function in \apps\home\controller\ParserController.php...