CVE-2019-8334: Improper Neutralization of Input During Web Page Generation

An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&viewid=XSS...

CVE-2019-8335: Improper Neutralization of Input During Web Page Generation

An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index&c=Channel&m=Home&id=XSS...

Design/Logic Flaw

Verydows 2.0 has XSS via the index.php?m=api&c=stats&a=count referrer parameter...

CVE-2019-7753

The connected documents confirm CVE-2019-7753 applies to Verydows 2.0, with an XSS vulnerability exposed via the index.php?m=api&c=stats&a=count referrer parameter. Red Hat and NVD entries corroborate this issue, describing an input/referrer parameter that can inject scripts. No public exploit de...

PT-2019-18744

Name of the Vulnerable Software and Affected Versions Verydows version 2.0 Description The issue is related to a security problem where an attacker can inject malicious code. The estimated number of potentially affected devices worldwide is not available. The problem can be exploited through the...

CVE-2019-7753: Improper Neutralization of Input During Web Page Generation

Verydows 2.0 has XSS via the index.php?m=api&c=stats&a=count referrer parameter...

CVE-2019-7737

A CSRF vulnerability was found in Verydows v2.0 that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit...

CVE-2019-7737

Verydows v2.0 is affected by a CSRF vulnerability that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit. The issue is documented in CVE-2019-7737 with NVD metrics indicating high impact (C/H/I/A) and network attack vector, requiring no authentication. Connected sources c...

CVE-2019-7721

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

CVE-2019-7721

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

CVE-2019-7721

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

PT-2019-18720

Name of the Vulnerable Software and Affected Versions Metinfo versions 6.x Description An issue was discovered that allows an attacker to execute arbitrary PHP code via a race condition in the backend database backup function. This can be achieved by leveraging the admin/index.php and...

PT-2019-18731

Name of the Vulnerable Software and Affected Versions Verydows version 2.0 Description A CSRF issue was discovered that allows adding an admin account via the "index.php?m=backend&c=admin&a=add&step=submit" endpoint, specifically by manipulating the a and step variables. Recommendations For versi...

CVE-2019-7737: Cross-Site Request Forgery (CSRF)

A CSRF vulnerability was found in Verydows v2.0 that can add an admin account via index.php?m=backend&c=admin&a=add&step=submit...

CVE-2019-7721: Unrestricted Upload of File with Dangerous Type

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

CVE-2019-7718: Concurrent Execution using Shared Resource with Improper Synchronization

An issue was discovered in Metinfo 6.x. An attacker can leverage a race condition in the backend database backup function to execute arbitrary PHP code via admin/index.php?n=databack&c=index&a=dogetsql&tables=...

PT-2019-18723

Name of the Vulnerable Software and Affected Versions nc-cms version 3.5 Description The issue allows for the upload of .php files. This is achieved through the index.php?action=save endpoint, utilizing the name and editordata parameters. Recommendations For nc-cms version 3.5, restrict access to...

Sql injection

An issue was discovered in baijiacms V4 that can result in time-based blind SQL injection to get data via the cate parameter in an index.php?act=index request...

CVE-2019-7568

An issue was discovered in baijiacms V4 that can result in time-based blind SQL injection to get data via the cate parameter in an index.php?act=index request...

CVE-2019-7568

The CVE-2019-7568 issue affects baijiacms V4. It describes a time-based blind SQL injection in the cate parameter exposed through index.php?act=index, enabling data retrieval from the database. The NVD record lists a high/critical risk profile (CVSS v2 base 7.5, CVSS v3 base 9.8) indicating netwo...