13518 matches found
PT-2019-12283
Name of the Vulnerable Software and Affected Versions UliCMS versions 2019.1 through 2019.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, o...
CVE-2019-11564: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in HumHub 1.3.12 allows remote attackers to inject arbitrary web script or HTML via a /protected/vendor/codeception/codeception/tests/data/app/view/index.php POST request...
PT-2019-12383
Name of the Vulnerable Software and Affected Versions HumHub version 1.3.12 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a "POST request to /protected/vendor/codeception/codeception/tests/data/app/view/index.php". Recommendations...
CVE-2019-11398: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon...
CVE-2018-13983
ImpressCMS 1.3.10 has XSS via the PATHINFO to htdocs/install/index.php, htdocs/install/pagelangselect.php, or htdocs/install/pagemodcheck.php...
CVE-2018-13983
ImpressCMS 1.3.10 is affected by an XSS vulnerability triggered via PATH_INFO to htdocs/install/index.php, htdocs/install/page_langselect.php, or htdocs/install/page_modcheck.php. The root cause is unvalidated PATH_INFO leading to cross-site scripting, enabling arbitrary HTML/JS execution in a us...
PT-2019-9012
Name of the Vulnerable Software and Affected Versions ImpressCMS version 1.3.10 Description The issue concerns a cross-site scripting XSS problem. It occurs via the PATH INFO to specific endpoints, including "htdocs/install/index.php", "htdocs/install/page langselect.php", or "htdocs/install/page...
CVE-2018-13983: Improper Neutralization of Input During Web Page Generation
ImpressCMS 1.3.10 has XSS via the PATHINFO to htdocs/install/index.php, htdocs/install/pagelangselect.php, or htdocs/install/pagemodcheck.php...
HumHub 1.3.12 - Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: HumHub 1.3.12 - Cross-Site Scripting Exploit Author: Kağan EĞLENCE Vendor Homepage: https://humhub.org/ Version: 1.3.12 CVE : CVE-2019-11564 Url :...
CVE-2019-11626
routers/ajaxRouter.php in doorGets 7.0 has a web site physical path leakage vulnerability, as demonstrated by an ajax/index.php?uri=1234%5c request...
CVE-2019-11626
CVE-2019-11626 affects doorGets 7.0, where routers/ajaxRouter.php exposes a web site physical path via an ajax/index.php?uri=1234\ request. The published sources (NVD, Red Hat, CNVD, CVE lists) describe an information-disclosure vulnerability in doorGets 7.0’s AJAX router, enabling path leakage. ...
PT-2019-12433
Name of the Vulnerable Software and Affected Versions doorGets version 7.0 Description The issue is related to a web site physical path leakage. This can be demonstrated by sending a request to the 'ajax/index.php?uri=1234' endpoint, which is handled by the routers/ajaxRouter.php file in doorGets...
Joomla! Component JiFile 2.3.1 - Arbitrary File Download
Exploit Title: Joomla! Component JiFile 2.3.1 - Arbitrary File Download Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: April 28, 2019 Vendor Homepage: http://www.isapp.it Software Link :...
PT-2019-12425
Name of the Vulnerable Software and Affected Versions doorGets version 7.0 Description The issue allows a remote attacker to gain administrator privileges for creating and modifying articles. This can be achieved by exploiting a default administrator credential vulnerability, potentially using an...
CVE-2019-11626: Undefined Security Weakness
routers/ajaxRouter.php in doorGets 7.0 has a web site physical path leakage vulnerability, as demonstrated by an ajax/index.php?uri=1234%5c request...
CVE-2019-11618: Initialization of a Resource with an Insecure Default
doorGets 7.0 has a default administrator credential vulnerability. A remote attacker can use this vulnerability to gain administrator privileges for the creation and modification of articles via an H0XZlT44FcN1j9LTdFc5XRXhlF30UaGe1g3cZY6i1K9 accesstoken in a uri=blog&action=index&controller=blog...
CVE-2019-11452
whatsns 4.0 allows index.php?admincategory/remove.html cid SQL injection...
Sql injection
whatsns 4.0 allows index.php?question/ajaxadd.html title SQL injection...