PT-2021-10315

Name of the Vulnerable Software and Affected Versions: Dswjcms version 1.6.4 Description: A stored cross-site scripting XSS issue in the index.php/Dswjcms/Site/articleList component allows attackers to execute arbitrary web scripts or HTML. This could potentially lead to unauthorized actions on t...

PT-2021-10313

Name of the Vulnerable Software and Affected Versions: MipCMS version 5.0.1 Description: A cross-site request forgery CSRF issue allows attackers to arbitrarily add users via the "index.php?s=/user/ApiAdminUser/itemAdd" API endpoint. This enables unauthorized access to add new users...

CVE-2020-19267: Unrestricted Upload of File with Dangerous Type

An issue in index.php/Dswjcms/Basis/resources of Dswjcms 1.6.4 allows attackers to execute arbitrary code via uploading a crafted PHP file...

PT-2021-10317

Name of the Vulnerable Software and Affected Versions: Dswjcms version 1.6.4 Description: A cross-site request forgery CSRF issue in the "index.php/Dswjcms/User/tfAdd" endpoint of Dswjcms allows authenticated attackers to arbitrarily add administrator users. Recommendations: For Dswjcms version...

PT-2021-10312

Name of the Vulnerable Software and Affected Versions: MipCMS version 5.0.1 Description: A cross-site request forgery CSRF issue allows attackers to escalate user privileges to administrator. This can be achieved via the "index.php?s=/user/ApiAdminUser/itemEdit" endpoint, by exploiting the lack o...

CVE-2020-19268: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF in index.php/Dswjcms/User/tfAdd of Dswjcms 1.6.4 allows authenticated attackers to arbitrarily add administrator users...

PT-2021-10316

Name of the Vulnerable Software and Affected Versions: Dswjcms version 1.6.4 Description: An issue in the index.php/Dswjcms/Basis/resources component of Dswjcms allows attackers to execute arbitrary code via uploading a crafted PHP file. Recommendations: For Dswjcms version 1.6.4, consider...

CVE-2020-19265: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the index.php/Dswjcms/Basis/links component of Dswjcms 1.6.4 allows attackers to execute arbitrary web scripts or HTML...

CVE-2021-40492

A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaScript gibbonCourseClassID, gibbonPersonID, subpage, currentDate, or allStudents to index.php...

Cross site scripting

A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaScript gibbonCourseClassID, gibbonPersonID, subpage, currentDate, or allStudents to index.php...

PT-2021-22898

Name of the Vulnerable Software and Affected Versions Gibbon version 22 Description A reflected XSS issue exists in multiple pages of the Gibbon application, allowing for arbitrary execution of JavaScript. This is achieved by manipulating parameters such as gibbonCourseClassID, gibbonPersonID,...

CVE-2021-40492: Improper Neutralization of Input During Web Page Generation

A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaScript gibbonCourseClassID, gibbonPersonID, subpage, currentDate, or allStudents to index.php...

CVE-2020-20343

WTCMS 1.0 contains a cross-site request forgery CSRF vulnerability in the index.php?g=admin&m=nav&a=addpost component that allows attackers to arbitrarily add articles in the administrator background...

Sql injection

A SQL Injection vulnerability exists in openSIS 8.0 when MySQL MariaDB is being used as the application database. A malicious attacker can issue SQL commands to the MySQL MariaDB database through the index.php username parameter...

CVE-2021-39377

A SQL Injection vulnerability exists in openSIS 8.0 when MySQL MariaDB is being used as the application database. A malicious attacker can issue SQL commands to the MySQL MariaDB database through the index.php username parameter...

CVE-2021-40353

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the index.php USERNAME parameter. NOTE: this issue may exist because of an incomplete fix for CVE-2020-6637...

Sql injection

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the index.php USERNAME parameter. NOTE: this issue may exist because of an incomplete fix for CVE-2020-6637...

CVE-2021-40353: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the index.php USERNAME parameter. NOTE: this issue may exist because of an incomplete fix for CVE-2020-6637...

CVE-2021-39377: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability exists in openSIS 8.0 when MySQL MariaDB is being used as the application database. A malicious attacker can issue SQL commands to the MySQL MariaDB database through the index.php username parameter...

PT-2021-4493

Name of the Vulnerable Software and Affected Versions openSIS version 8.0 Description A SQL Injection issue exists, allowing a malicious attacker to issue SQL commands to the database through the username parameter in the "index.php" endpoint. This can enable a remote attacker to execute arbitrar...