xujinliang zibbs cross-site scripting vulnerability

Zibbs Zibbs Forum is a Bootstrap-based Php light forum system. xujinliang zibbs version 1.0 is vulnerable to a cross-site scripting vulnerability that stems from a lack of effective filtering and escaping of the route parameter in index.php. An attacker could use this vulnerability to execute...

Cross site scripting

Cross site scripting XSS vulnerability in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the route parameter to index.php...

PT-2021-10936

Name of the Vulnerable Software and Affected Versions zibbs version 1.0 Description A cross-site scripting XSS issue allows attackers to execute arbitrary code via the route parameter to "index.php". This could potentially lead to unauthorized actions on the affected system. Recommendations For...

CVE-2020-23718: Improper Neutralization of Input During Web Page Generation

Cross site scripting XSS vulnerability in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the route parameter to index.php...

CVE-2021-36548

A remote code execution RCE vulnerability in the component /admin/index.php?id=themes&action=edittemplate&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary commands via a crafted PHP file...

PT-2021-21286

Name of the Vulnerable Software and Affected Versions Monstra version 3.0.4 Description A remote code execution issue in the /admin/index.php?id=themes&action=edit template&filename=blog component allows attackers to execute arbitrary commands via a crafted PHP file. Recommendations For Monstra...

CVE-2021-36548: Unrestricted Upload of File with Dangerous Type

A remote code execution RCE vulnerability in the component /admin/index.php?id=themes&action=edittemplate&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary commands via a crafted PHP file...

openSIS SQL Injection

The vulnerability of the information system openSIS is related to the failure to implement measures to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries using the index.php USERNAME parameter...

SQL Injection in flatcore/flatcore-cms

Pre-Auth SQL injection Description flatCore-CMS is vulnerable to variable-overwritten vulnerability, leading to a Pre-Auth SQL injection in index.php ​ source code 1 at index.phpL41 php $fcprefs = fcgetpreferences; $languagePack = $fcprefs'prefsdefaultlanguage'; $SESSION'fcadminhelpers' = array; ...

CVE-2020-28145

Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitive information...

CVE-2020-28145: Exposure of Resource to Wrong Sphere

Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitive information...

CVE-2020-21649

Myucms v2.2.1 contains a server-side request forgery SSRF in the component \controller\index.php, which can be exploited via the sql method...

CVE-2020-21653

Myucms v2.2.1 contains a server-side request forgery SSRF in the component \controller\index.php, which can be exploited via the sj method...

CVE-2020-21653

CVE-2020-21653 affects Myucms v2.2.1, where a server-side request forgery (SSRF) exists in the component \controller\index.php, exploitable via the sj() method. The vulnerability is triggered in the server-side code path and can impact confidentiality and integrity (per CVSS 3.1: High impact on c...

CVE-2020-21649

Myucms v2.2.1 contains a server-side request forgery SSRF in the component \controller\index.php, which can be exploited via the sql method...

CVE-2020-21649

Myucms v2.2.1 contains a server-side request forgery (SSRF) vulnerability in the component \controller\index.php, exploitable via the sql() method. Affected product: Myucms. Root cause: SSRF in the controller/index.php area. Impact details are not expanded beyond SSRF susceptibility in the provid...

CVE-2020-21653: Server-Side Request Forgery (SSRF)

Myucms v2.2.1 contains a server-side request forgery SSRF in the component \controller\index.php, which can be exploited via the sj method...

CVE-2020-21649: Server-Side Request Forgery (SSRF)

Myucms v2.2.1 contains a server-side request forgery SSRF in the component \controller\index.php, which can be exploited via the sql method...

CVE-2020-21503

waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=gift&a=addsave credit parameter to -1, the product is sold for free...

CVE-2020-21503: Exposure of Resource to Wrong Sphere

waimai Super Cms 20150505 has a logic flaw allowing attackers to modify a price, before form submission, by observing data in a packet capture. By setting the index.php?m=gift&a=addsave credit parameter to -1, the product is sold for free...