13592 matches found
CVE-2018-16625: Improper Neutralization of Input During Web Page Generation
index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...
CVE-2018-16626: Improper Neutralization of Input During Web Page Generation
index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name...
Cross site request forgery (csrf)
Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state...
CVE-2017-12790
Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state...
CVE-2017-12790
CVE-2017-12790 : MetInfo 5.3.18 is affected by Cross Site Request Forgery (CSRF) affecting the admin/index.php component. The attack vector involves an administrator clicking a malicious link while logged in. Reported impact is Information Disclosure (remote). The Red Hat, NVD, PRION, and CVE cat...
CVE-2017-12790
Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state...
CVE-2017-12788
CVE-2017-12788 affects MetInfo CMS (version 5.3.18) via admin/index.php . Vulnerable parameters are class1 and anyid , enabling multiple XSS by remote attackers to inject script/HTML. The documents do not provide exploitable details beyond the parameter vectors or any available remediation. No ex...
PT-2019-10268
Name of the Vulnerable Software and Affected Versions: Typesetter version 5.1 Description: The issue concerns an XSS vulnerability in the include/admin/Menu/Ajax.php file. Specifically, it affects the "index.php/Admin/Menu/Ajax?cmd=AddHidden" endpoint, where the title parameter is vulnerable to X...
PT-2019-7917
Name of the Vulnerable Software and Affected Versions Metinfo version 5.3.18 Description The issue allows for Information Disclosure through a remote attack vector. It involves a Cross Site Request Forgery CSRF attack, where the administrator clicks on a malicious link while in a logged-in state...
PT-2019-7915
Name of the Vulnerable Software and Affected Versions Metinfo version 5.3.18 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occur via the class1 parameter or t...
CVE-2018-20837: Improper Neutralization of Input During Web Page Generation
include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS...
CVE-2017-12788: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HTML via the 1 class1 parameter or the 2 anyid parameter...
CVE-2017-12790: Cross-Site Request Forgery (CSRF)
Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state...
CVE-2019-11398
Multiple cross-site scripting XSS vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon...
CVE-2019-11398: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon...
PT-2019-12283
Name of the Vulnerable Software and Affected Versions UliCMS versions 2019.1 through 2019.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, o...
CVE-2019-11564: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in HumHub 1.3.12 allows remote attackers to inject arbitrary web script or HTML via a /protected/vendor/codeception/codeception/tests/data/app/view/index.php POST request...
PT-2019-12383
Name of the Vulnerable Software and Affected Versions HumHub version 1.3.12 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a "POST request to /protected/vendor/codeception/codeception/tests/data/app/view/index.php". Recommendations...
CVE-2018-13983
ImpressCMS 1.3.10 is affected by an XSS vulnerability triggered via PATH_INFO to htdocs/install/index.php, htdocs/install/page_langselect.php, or htdocs/install/page_modcheck.php. The root cause is unvalidated PATH_INFO leading to cross-site scripting, enabling arbitrary HTML/JS execution in a us...