CVE-2018-16626

CVE-2018-16626 affects Typesetter 5.1: index.php/Admin/Classes allows cross-site scripting via the description of a new class name. The vulnerability is an XSS in the class-creation workflow, arising from how the description field is processed in Admin/Classes. Public references in the connected ...

CVE-2018-16639

CVE-2018-16639 affects Typesetter 5.1. The vulnerability allows a Cross-Site Scripting (XSS) attack via the index.php/Admin LABEL parameter during new page creation, stemming from insufficient validation of client-side data. Public sources (NVD, RH/Red Hat, OSV, CNVD, CVE List, etc.) consistently...

CVE-2018-16639: Improper Neutralization of Input During Web Page Generation

Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation...

PT-2019-9362

Name of the Vulnerable Software and Affected Versions Typesetter version 5.1 Description The issue allows for XSS via the LABEL parameter in the "index.php/Admin" endpoint during new page creation. Recommendations For version 5.1, avoid using the LABEL parameter in the "index.php/Admin" endpoint...

PT-2019-9360

Name of the Vulnerable Software and Affected Versions Typesetter version 5.1 Description The issue allows for XSS via an SVG file with JavaScript in a SCRIPT element, specifically in the index.php/Admin/Uploaded component. Recommendations For version 5.1, consider restricting access to the...

PT-2019-9361

Name of the Vulnerable Software and Affected Versions Typesetter version 5.1 Description The issue allows for XSS via the description of a new class name in the index.php/Admin/Classes endpoint. Recommendations For version 5.1, update to a newer version that contains a fix for this issue, or as a...

CVE-2018-16625: Improper Neutralization of Input During Web Page Generation

index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...

CVE-2018-16626: Improper Neutralization of Input During Web Page Generation

index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name...

CVE-2017-12790

Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state...

Cross site request forgery (csrf)

Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state...

CVE-2017-12790

Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state...

CVE-2017-12790

CVE-2017-12790 : MetInfo 5.3.18 is affected by Cross Site Request Forgery (CSRF) affecting the admin/index.php component. The attack vector involves an administrator clicking a malicious link while logged in. Reported impact is Information Disclosure (remote). The Red Hat, NVD, PRION, and CVE cat...

CVE-2017-12788

CVE-2017-12788 affects MetInfo CMS (version 5.3.18) via admin/index.php . Vulnerable parameters are class1 and anyid , enabling multiple XSS by remote attackers to inject script/HTML. The documents do not provide exploitable details beyond the parameter vectors or any available remediation. No ex...

PT-2019-10268

Name of the Vulnerable Software and Affected Versions: Typesetter version 5.1 Description: The issue concerns an XSS vulnerability in the include/admin/Menu/Ajax.php file. Specifically, it affects the "index.php/Admin/Menu/Ajax?cmd=AddHidden" endpoint, where the title parameter is vulnerable to X...

PT-2019-7917

Name of the Vulnerable Software and Affected Versions Metinfo version 5.3.18 Description The issue allows for Information Disclosure through a remote attack vector. It involves a Cross Site Request Forgery CSRF attack, where the administrator clicks on a malicious link while in a logged-in state...

PT-2019-7915

Name of the Vulnerable Software and Affected Versions Metinfo version 5.3.18 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via the class1 parameter or t...

CVE-2017-12788: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HTML via the 1 class1 parameter or the 2 anyid parameter...

CVE-2018-20837: Improper Neutralization of Input During Web Page Generation

include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS...

CVE-2017-12790: Cross-Site Request Forgery (CSRF)

Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state...

CVE-2019-11398

Multiple cross-site scripting XSS vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon...