CVE-2013-7468: Improper Control of Generation of Code

Simple Machines Forum SMF 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter...

PT-2019-18686

Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description A stored Cross-site Scripting XSS issue was found. The username parameter of the "/install/index.php" page is vulnerable. This can be demonstrated via the "admin/login.php" page. Recommendations For PHPMyWind...

PT-2019-19039

Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A Stored XSS issue was found in the second textbox of "System setting-site setting" in admin/index.php, specifically related to the site domain. Recommendations For DiliCMS version 2.4.0, at the moment, there ...

PT-2019-19762

Name of the Vulnerable Software and Affected Versions PHPSHE version 1.7 Description The issue allows for SQL Injection in the pintuan id parameter to the /index.php endpoint via the module/index/cart.php file. Recommendations For PHPSHE version 1.7, consider restricting access to the cart.php...

PT-2019-19037

Name of the Vulnerable Software and Affected Versions njiandan-cms versions prior to 2013-05-23 Description The issue allows for a CSRF attack via the index.php/admin/user new endpoint to add an administrator. Recommendations For versions prior to 2013-05-23, update to a version released after...

CVE-2019-8440: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox aka site logo of "System setting-site setting" of admin/index.php, aka sitelogo...

CVE-2019-7660: Improper Neutralization of Input During Web Page Generation

An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site Scripting XSS vulnerability, as demonstrated by admin/login.php...

CVE-2018-17426: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI...

CVE-2019-8439: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the second textbox of "System setting-site setting" of admin/index.php, aka sitedomain...

CVE-2018-17425: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 has stored XSS via the "Membership Center" "I want to ask" "detailed description" field under the index.php?m=member URI...

CVE-2019-8437: Cross-Site Request Forgery (CSRF)

njiandan-cms through 2013-05-23 has index.php/admin/usernew CSRF to add an administrator...

CVE-2019-9626: Improper Neutralization of Special Elements used in an SQL Command

PHPSHE 1.7 allows module/index/cart.php pintuanid SQL Injection to index.php...

CVE-2019-8438: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the first textbox of "System setting-site setting" of admin/index.php, aka sitename...

CVE-2013-7467: Improper Neutralization of Input During Web Page Generation

Simple Machines Forum SMF 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter...

PT-2019-19038

Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A Stored XSS issue was found in the first textbox of "System setting-site setting" in admin/index.php, specifically affecting the site name variable. Recommendations For DiliCMS version 2.4.0, as a temporary...

PT-2019-19449

Name of the Vulnerable Software and Affected Versions baigo CMS version 2.1.1 Description A persistent XSS issue allows remote attackers to inject arbitrary web script or HTML via the optbaseBG SITE NAME parameter to the "bg console/index.php?m=opt&c=request" URI. Recommendations For baigo CMS...

CVE-2019-9226: Improper Neutralization of Input During Web Page Generation

An issue was discovered in baigo CMS 2.1.1. There is a persistent XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the optbaseBGSITENAME parameter to the bgconsole/index.php?m=opt&c=request URI...

Cross site scripting

XSS exists in WUZHI CMS 4.1.0 via index.php?m=core&f=map&v=baidumap&x=XSS&y=XSS to coreframe/app/core/map.php...

CVE-2019-9110

XSS exists in WUZHI CMS 4.1.0 via index.php?m=content&f=postinfo&v=listing&setiframe=XSS to coreframe/app/content/postinfo.php...

PT-2019-19363

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A security issue exists where an XSS attack can be performed. The issue is related to the "index.php?m=message&f=message&v=add" endpoint, specifically with the username variable. Recommendations For WUZHI CM...