CVE-2018-19601

Rhymix CMS 1.9.8.1 allows SSRF via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...

CVE-2018-19600

Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...

CVE-2018-14481

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...

Design/Logic Flaw

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...

CVE-2018-14481

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...

CVE-2018-14481

OSClass 3.7.4 is affected by CVE-2018-14481: it has Cross-Site Scripting (XSS) via the query string to index.php (notably in the OSClass 3.7.4 release, separate from CVE-2014-6280). Other connected sources describe multiple XSS vulnerabilities in OSClass 3.7.4, including potential reflections and...

PT-2019-9874

Name of the Vulnerable Software and Affected Versions Rhymix CMS version 1.9.8.1 Description The issue allows for Server-Side Request Forgery SSRF via an SVG upload in the admin module. This can be achieved by accessing the "index.php?module=admin&act=dispModuleAdminFileBox" endpoint with a...

CVE-2018-19600: Improper Neutralization of Input During Web Page Generation

Rhymix CMS 1.9.8.1 allows XSS via an index.php?module=admin&act=dispModuleAdminFileBox SVG upload...

PT-2019-9027

Name of the Vulnerable Software and Affected Versions Osclass version 3.7.4 Description The issue is related to a Cross-Site Scripting XSS vulnerability. It occurs via the query string to the "index.php" endpoint. Recommendations For Osclass version 3.7.4, update to a version that includes a fix...

CVE-2018-14481: Improper Neutralization of Input During Web Page Generation

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280...

PT-2019-10011

Name of the Vulnerable Software and Affected Versions: Rukovoditel version 2.3.1 Description: A file-upload issue exists, allowing users to upload PHP content by exploiting a weakness in extension checking. The "index.php?module=configuration/save" endpoint accepts uploads if the first few...

CVE-2018-20166: Unrestricted Upload of File with Dangerous Type

A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?module=configuration/save allows the user to upload a background image, and mishandles extension checking. It accepts uploads of PHP content if the first few characters match GIF data, and the filename ends in ".php" with mixed...

Design/Logic Flaw

UCMS 1.4.7 allows remote attackers to execute arbitrary PHP code by entering this code during an index.php sadminfileedit action...

Design/Logic Flaw

UCMS 1.4.7 has XSS via the dir parameter in an index.php sadminfileedit action...

Design/Logic Flaw

UCMS 1.4.7 has XSS via the description parameter in an index.php listeditpost action...

CVE-2018-20597

UCMS 1.4.7 has XSS via the dir parameter in an index.php sadminfileedit action...

CVE-2018-20597

UCMS 1.4.7 has XSS via the dir parameter in an index.php sadminfileedit action...

CVE-2018-20601

UCMS 1.4.7 has XSS via the description parameter in an index.php listeditpost action...

CVE-2018-20600

CVE-2018-20600 affects UCMS 1.4.7 where sadmin\cedit.php is vulnerable to cross-site scripting via the index.php sadmin_cedit action. The vulnerability allows injection of arbitrary web script or HTML, with the CVSS 3.0/2.0 metrics indicating network access, no authentication, user interaction re...

CVE-2018-20601

UCMS 1.4.7 is affected by a Cross‑Site Scripting (XSS) flaw in the description parameter used by the index.php list_editpost action. The root cause, as described across sources, is unescaped or insufficiently sanitized input in the description field that can be reflected in the rendered page. Thi...