PT-2019-19860

Name of the Vulnerable Software and Affected Versions PilusCart version 1.4.1 Description The issue allows for a CSRF attack via the "index.php?module=users&action=newUser" endpoint, potentially leading to the addition of a new user with administrator privileges. Recommendations For PilusCart...

CVE-2019-9688

sftnow through 2018-12-29 allows index.php?g=Admin&m=User&a=addpost CSRF to add an admin account...

PT-2019-19798

Name of the Vulnerable Software and Affected Versions sftnow versions prior to 2018-12-29 Description The issue allows for a CSRF attack via the "index.php?g=Admin&m=User&a=add post" endpoint to add an admin account. Recommendations For versions prior to 2018-12-29, update to a version released...

CVE-2019-9688: Cross-Site Request Forgery (CSRF)

sftnow through 2018-12-29 allows index.php?g=Admin&m=User&a=addpost CSRF to add an admin account...

CVE-2018-17426

WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI...

CVE-2018-17425

WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI...

CVE-2013-7468

Simple Machines Forum SMF 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter...

CVE-2013-7467

Simple Machines Forum SMF 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter...

CVE-2019-8440

An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox aka site logo of "System setting-site setting" of admin/index.php, aka sitelogo...

CVE-2019-8440

An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox aka site logo of "System setting-site setting" of admin/index.php, aka sitelogo...

CVE-2018-17426

WUZHI CMS 4.1.0 is affected by a stored XSS vulnerability in the Extension module, specifically the "SMS in station" field under index.php?m=core. The issue is caused by improper input handling in that field, enabling arbitrary HTML/JS injection. No exploit details or remediation are provided in ...

CVE-2018-17425

WUZHI CMS 4.1.0 contains a stored XSS vulnerability in the Membership Center’s “I want to ask” -> “detailed description” field (index.php?m=member). Multiple sources (NVD, CNVD, OSV, CVE records) confirm that an attacker can inject script/HTML through this field, leading to stored XSS. No spec...

CVE-2019-8438

CVE-2019-8438 affects DiliCMS 2.4.0. A Stored XSS vulnerability exists in the first textbox of System setting -> site setting (admin/index.php), specifically the site_name field. The issue is described without exploit details in the provided sources; CVSS scores from NVD indicate a Low to Medi...

CVE-2013-7468

Affected software: Simple Machines Forum (SMF) 2.0.4. Vulnerability: PHP Code Injection via the dictionary parameter in the index.php?action=admin;area=languages;sa=editlang path. Root cause (as described): unsafely processed user-supplied dictionary parameter enables code execution. Impact (as s...

CVE-2019-8438

An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the first textbox of "System setting-site setting" of admin/index.php, aka sitename...

Sql injection

PHPSHE 1.7 allows module/index/cart.php pintuanid SQL Injection to index.php...

CVE-2019-9626

PHPSHE 1.7 allows module/index/cart.php pintuanid SQL Injection to index.php...

CVE-2019-9626

PHPSHE 1.7 allows module/index/cart.php pintuanid SQL Injection to index.php...

CVE-2019-9626

CVE-2019-9626 affects PHPSHE 1.7. The vulnerability is a SQL Injection in module/index/cart.php via the pintuan_id parameter reaching index.php. Root cause: improper handling/concatenation of input in cart.php leading to untrusted input affecting SQL queries. Impact (as stated): potential comprom...

PT-2019-9477

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue is related to stored XSS, which can be triggered via the Extension module and specifically the SMS in station field. This field is accessible under the index.php?m=core URI, which is an API endpoin...