CVE-2018-20569

The CVE-2018-20569 entry applies to the Ivan Cordoba Generic Content Management System (CMS) and concerns a SQL injection vulnerability in the file user/index.php up to 2018-04-28. The root cause is improper input handling in the authentication logic, enabling a bypass of authentication. If explo...

PT-2018-9482

Name of the Vulnerable Software and Affected Versions Battelle V2I Hub version 2.5.1 Description The issue is caused by improper validation of user-supplied input, allowing for cross-site scripting. A remote attacker could exploit this by using the parameterName or login username parameter in a...

PT-2018-15439

Name of the Vulnerable Software and Affected Versions Ivan Cordoba Generic Content Management System CMS versions through 2018-04-28 Description The issue allows for SQL injection, which can be used for authentication bypass. This means an attacker could potentially gain unauthorized access to th...

PT-2018-15437

Name of the Vulnerable Software and Affected Versions DouPHP version 1.5 20181221 Description An issue was discovered in DouCo DouPHP, where the /install/index.php endpoint allows a reload of the product under certain circumstances when the install.lock file cannot be read. Recommendations For...

CVE-2018-20572: Improper Neutralization of Special Elements used in an SQL Command

WUZHI CMS 4.1.0 allows coreframe/app/coupon/admin/copyfrom.php SQL injection via the index.php?m=promote&f=index&v=search keywords parameter, a related issue to CVE-2018-15893...

PT-2018-15442

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue allows SQL injection via the keywords parameter in the "index.php?m=promote&f=index&v=search" endpoint. Recommendations For WUZHI CMS version 4.1.0, avoid using the keywords parameter in the affect...

CVE-2018-20567: Incorrect Permission Assignment for Critical Resource

An issue was discovered in DouCo DouPHP 1.5 20181221. \install\index.php allows a reload of the product in opportunistic circumstances in which install.lock cannot be read...

CVE-2018-20569: Improper Neutralization of Special Elements used in an SQL Command

user/index.php in Ivan Cordoba Generic Content Management System CMS through 2018-04-28 allows SQL injection for authentication bypass...

CVE-2018-1000629: Improper Neutralization of Input During Web Page Generation

Battelle V2I Hub 2.5.1 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by api/SystemConfigActions.php?action=add and the index.php script. A remote attacker could exploit this vulnerability using the parameterName or loginusername parameter in a...

CVE-2018-20568: Improper Neutralization of Special Elements used in an SQL Command

Administrator/index.php in Ivan Cordoba Generic Content Management System CMS through 2018-04-28 allows SQL injection for authentication bypass...

PT-2018-15411

Name of the Vulnerable Software and Affected Versions 74cms version 4.2.111 Description An issue in 74cms allows remote authenticated users to read or modify arbitrary resumes. This is achieved by changing a job-search intention, specifically through the "index.php?c=Personal&a=ajax save basic"...

CVE-2018-20519: Improper Input Validation

An issue was discovered in 74cms v4.2.111. It allows remote authenticated users to read or modify arbitrary resumes by changing a job-search intention, as demonstrated by the index.php?c=Personal&a=ajaxsavebasic pid parameter...

PT-2018-15404

Name of the Vulnerable Software and Affected Versions S-CMS version 1.0 Description The issue allows SQL Injection via the "wap index.php?type=newsinfo" API endpoint, specifically through the S id parameter. Recommendations For S-CMS version 1.0, avoid using the S id parameter in the "wap...

PT-2018-15389

Name of the Vulnerable Software and Affected Versions 74cms version 4.2.111 Description A security issue was found in the software, where the "upload/index.php?c=resume&a=resume list" endpoint is vulnerable to XSS attacks via the key parameter. Recommendations For version 4.2.111, as a temporary...

PT-2018-15384

Name of the Vulnerable Software and Affected Versions Frog CMS version 0.9.5 Description The issue allows for XSS via the Database name field to the "/install/index.php" API endpoint. Recommendations For Frog CMS version 0.9.5, update to a version that fixes this issue, as using the Database name...

CVE-2018-20454: Improper Neutralization of Input During Web Page Generation

An issue was discovered in 74cms v4.2.111. upload/index.php?c=resume&a=resumelist has XSS via the key parameter...

CVE-2018-20448: Improper Neutralization of Input During Web Page Generation

Frog CMS 0.9.5 has XSS via the Database name field to the /install/index.php URI...

CVE-2018-20418

index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab...

CVE-2018-20418: Improper Neutralization of Input During Web Page Generation

index.php?p=admin/actions/entries/save-entry in Craft CMS 3.0.25 allows XSS by saving a new title from the console tab...

PT-2018-15362

Name of the Vulnerable Software and Affected Versions Craft CMS version 3.0.25 Description The issue allows for cross-site scripting XSS by saving a new title from the console tab, specifically through the "index.php?p=admin/actions/entries/save-entry" endpoint. Recommendations For Craft CMS...