PT-2021-10343

Name of the Vulnerable Software and Affected Versions: Vtiger CRM version 7.2.0 Description: The issue is related to Reflected XSS in Vtiger CRM, where an attacker can perform malicious actions on users who open a maliciously crafted link or third-party web page through the view parameter in...

PT-2021-16506

Name of the Vulnerable Software and Affected Versions: OpenCATS versions 0.9.5-3 and earlier Description: The issue arises from the unsafe deserialization of requests to "index.php?m=activity", leading to remote code execution. This occurs because lib/DataGrid.php calls unserialize for the...

CVE-2020-23644

XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg=XSS to Home/c/ErrorController.php...

CVE-2020-23644

XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg=XSS to Home/c/ErrorController.php...

CVE-2020-23643

XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr=XSS to Home/c/WechatController.php...

PT-2021-10921

Name of the Vulnerable Software and Affected Versions JIZHICMS version 1.7.1 Description A security issue exists where an attacker can execute arbitrary code. The issue is related to the "/index.php/Error/index?msg=" API endpoint, which is vulnerable to XSS attacks. This endpoint is handled by th...

CVE-2020-23644: Improper Neutralization of Input During Web Page Generation

XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg=XSS to Home/c/ErrorController.php...

CVE-2020-23643: Improper Neutralization of Input During Web Page Generation

XSS exists in JIZHICMS 1.7.1 via index.php/Wechat/checkWeixin?signature=1&echostr=XSS to Home/c/WechatController.php...

PT-2021-10920

Name of the Vulnerable Software and Affected Versions JIZHICMS version 1.7.1 Description A security issue exists where an attacker can inject malicious code. The issue is related to the "index.php/Wechat/checkWeixin" API endpoint, specifically with the signature and echostr parameters, where an...

CVE-2021-3111: Improper Neutralization of Input During Web Page Generation

The Express Entries Dashboard in Concrete5 8.5.4 allows stored XSS via the name field of a new data object at an index.php/dashboard/express/entries/view/ URI...

PT-2021-19148

Name of the Vulnerable Software and Affected Versions Concrete5 version 8.5.4 Description The issue allows stored XSS via the name field of a new data object at the "index.php/dashboard/express/entries/view/" URI. This occurs in the Express Entries Dashboard. Recommendations For Concrete5 version...

PT-2021-11575

Name of the Vulnerable Software and Affected Versions: MonoCMS Blog version 1.0 Description: The issue is related to incorrect access control, which can lead to remote arbitrary code execution. Specifically, at monofiles/category.php:27, user input can be saved to category/foldername/index.php,...

Advanced Comment System 1.0 - 'ACS_path' Path Traversal

Exploit Title: Advanced Comment System 1.0 - 'ACSpath' Path Traversal Date: Fri, 11 Dec 2020 Exploit Author: Francisco Javier Santiago Vázquez aka "n0ipr0cs" Vendor Homepage: Advanced Comment System - ACS Version: v1.0 CVE: CVE-2020-35598...

CVE-2020-35388

rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true...

Design/Logic Flaw

rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true...

CVE-2020-35388: Undefined Security Weakness

rainrocka xinhu 2.1.9 allows remote attackers to obtain sensitive information via an index.php?a=gettotal request in which the ajaxbool value is manipulated to be true...

PT-2020-17322

Name of the Vulnerable Software and Affected Versions rainrocka xinhu version 2.1.9 Description The issue allows remote attackers to obtain sensitive information via an "index.php?a=gettotal" request in which the ajaxbool value is manipulated to be true. This can lead to unauthorized access to...

CVE-2020-35709

bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...

PT-2020-17398

Name of the Vulnerable Software and Affected Versions bloofoxCMS version 0.5.2.1 Description The issue allows admins to upload arbitrary .php files to ../media/images/ via the "admin/index.php?mode=tools&page=upload" URI, which is a directory traversal issue. This is achieved by using a...

CVE-2020-35709: Improper Limitation of a Pathname to a Restricted Directory

bloofoxCMS 0.5.2.1 allows admins to upload arbitrary .php files with "Content-Type: application/octet-stream" to ../media/images/ via the admin/index.php?mode=tools&page=upload URI, aka directory traversal...