PT-2021-22070

Name of the Vulnerable Software and Affected Versions spideranalyse WordPress plugin version 0.0.1 Description The issue allows attackers to inject arbitrary web scripts via Reflected Cross-Site Scripting, utilizing the date parameter in the /analyse/index.php file. Recommendations For...

PT-2021-22073

Name of the Vulnerable Software and Affected Versions Dropdown and scrollable Text WordPress plugin versions up to and including 2.0 Description The issue allows attackers to inject arbitrary web scripts via the content parameter found in the /index.php file, enabling Reflected Cross-Site Scripti...

CVE-2021-38350: Improper Neutralization of Input During Web Page Generation

The spideranalyse WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the date parameter found in the /analyse/index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.1...

CVE-2021-38353: Improper Neutralization of Input During Web Page Generation

The Dropdown and scrollable Text WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the /index.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0...

CVE-2021-40373: Improper Control of Generation of Code

playSMS before 1.4.5 allows Arbitrary Code Execution by entering PHP code at the tabs-information-page of coremainconfig, and then executing that code via the index.php?app=main&inc=corewelcome URI...

WordPress plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the...

CVE-2020-19265

A stored cross-site scripting XSS vulnerability in the index.php/Dswjcms/Basis/links component of Dswjcms 1.6.4 allows attackers to execute arbitrary web scripts or HTML...

CVE-2020-19268

A cross-site request forgery CSRF in index.php/Dswjcms/User/tfAdd of Dswjcms 1.6.4 allows authenticated attackers to arbitrarily add administrator users...

Cross site request forgery (csrf)

A cross-site request forgery CSRF in index.php/Dswjcms/User/tfAdd of Dswjcms 1.6.4 allows authenticated attackers to arbitrarily add administrator users...

CVE-2020-19265

The provided documents confirm a stored cross-site scripting (XSS) vulnerability in Dswjcms 1.6.4, specifically in the index.php/Dswjcms/Basis/links component. The root cause is lack of proper validation/escaping of input parameters in that component, enabling attackers to store and execute arbit...

CVE-2021-38727

FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items...

CVE-2021-38723

FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items...

CVE-2021-38723

FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items...

PT-2021-10314

Name of the Vulnerable Software and Affected Versions: Dswjcms version 1.6.4 Description: A stored cross-site scripting XSS issue in the index.php/Dswjcms/Basis/links component allows attackers to execute arbitrary web scripts or HTML. This can lead to the execution of malicious code on the...

PT-2021-22276

Name of the Vulnerable Software and Affected Versions FUEL CMS version 1.5.0 Description The issue allows SQL Injection via the parameter col in the "/fuel/index.php/fuel/pages/items" API endpoint. This enables an attacker to inject malicious SQL code, potentially leading to unauthorized data...

Dropdown and scrollable Text <= 2.0 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the /index.php file which allows attackers to inject arbitrary web scripts...

PT-2021-10315

Name of the Vulnerable Software and Affected Versions: Dswjcms version 1.6.4 Description: A stored cross-site scripting XSS issue in the index.php/Dswjcms/Site/articleList component allows attackers to execute arbitrary web scripts or HTML. This could potentially lead to unauthorized actions on t...

PT-2021-10313

Name of the Vulnerable Software and Affected Versions: MipCMS version 5.0.1 Description: A cross-site request forgery CSRF issue allows attackers to arbitrarily add users via the "index.php?s=/user/ApiAdminUser/itemAdd" API endpoint. This enables unauthorized access to add new users...

PT-2021-10317

Name of the Vulnerable Software and Affected Versions: Dswjcms version 1.6.4 Description: A cross-site request forgery CSRF issue in the "index.php/Dswjcms/User/tfAdd" endpoint of Dswjcms allows authenticated attackers to arbitrarily add administrator users. Recommendations: For Dswjcms version...

PT-2021-10312

Name of the Vulnerable Software and Affected Versions: MipCMS version 5.0.1 Description: A cross-site request forgery CSRF issue allows attackers to escalate user privileges to administrator. This can be achieved via the "index.php?s=/user/ApiAdminUser/itemEdit" endpoint, by exploiting the lack o...