13467 matches found
CVE-2020-19157
Wenku CMS v3.4 contains a Cross Site Scripting (CSS) vulnerability in the ucenter index component. The flaw allows remote attackers to inject and execute arbitrary code via the Intro parameter in /index.php?m=ucenter&a=index. The NVD entry (CVE-2020-19157) lists CVSS2 base score 4.3 (MEDIUM) with...
CVE-2020-19157
Cross Site Scripting CSS in Wenku CMS v3.4 allows remote attackers to execute arbitrary code via the 'Intro' parameter for the component '/index.php?m=ucenter&a=index'...
CVE-2020-19159: Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery CSRF in LaikeTui v3 allows remote attackers to execute arbitrary code via the component '/index.php?module=member&action=add'...
CVE-2021-40845: Unrestricted Upload of File with Dangerous Type
The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php. Neither the content nor extension of the uploaded files is checked, allowing execution of PHP code under the /cmd directory...
PT-2021-10297
Name of the Vulnerable Software and Affected Versions: Wenku CMS version 3.4 Description: The issue allows remote attackers to execute arbitrary code via the Intro parameter for the component "/index.php?m=ucenter&a=index". This enables attackers to perform Cross Site Scripting CSS attacks...
PT-2021-22977
Name of the Vulnerable Software and Affected Versions Zenitel AlphaCom XE Audio Server versions through 11.2.3.10 Description The web part of Zenitel AlphaCom XE Audio Server, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at "php/index.php". Neither the content n...
CVE-2021-40373
playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the tabs-information-page of coremainconfig, and then executing that code via the index.php?app=main&inc=corewelcome URI...
CVE-2021-40373
playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the tabs-information-page of coremainconfig, and then executing that code via the index.php?app=main&inc=corewelcome URI...
CVE-2021-40373
playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the tabs-information-page of coremainconfig, and then executing that code via the index.php?app=main&inc=corewelcome URI...
CVE-2021-40373
playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the tabs-information-page of coremainconfig, and then executing that code via the index.php?app=main&inc=corewelcome URI...
CVE-2021-38353 Dropdown and scrollable Text <= 2.0 Reflected Cross-Site Scripting
The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the /index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0...
CVE-2021-38353
The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the /index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0...
CVE-2021-38353: Improper Neutralization of Input During Web Page Generation
The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the /index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0...
PT-2021-22070
Name of the Vulnerable Software and Affected Versions spideranalyse WordPress plugin version 0.0.1 Description The issue allows attackers to inject arbitrary web scripts via Reflected Cross-Site Scripting, utilizing the date parameter in the /analyse/index.php file. Recommendations For...
PT-2021-22073
Name of the Vulnerable Software and Affected Versions Dropdown and scrollable Text WordPress plugin versions up to and including 2.0 Description The issue allows attackers to inject arbitrary web scripts via the content parameter found in the /index.php file, enabling Reflected Cross-Site Scripti...
CVE-2021-38350: Improper Neutralization of Input During Web Page Generation
The spideranalyse WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the date parameter found in the /analyse/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.1...
WordPress 插件跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the...
CVE-2021-40373: Improper Control of Generation of Code
playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the tabs-information-page of coremainconfig, and then executing that code via the index.php?app=main&inc=corewelcome URI...