PT-2018-14977

Name of the Vulnerable Software and Affected Versions Zurmo version 3.2.4 Description The issue allows for XSS via an admin's use of the name parameter in the reports section. This can be exploited through the /app/index.php/reports/default/details?id=1 API endpoint. Recommendations For Zurmo...

CVE-2018-16636

Nucleus CMS 3.70 allows HTML Injection via the index.php body parameter...

Design/Logic Flaw

Nucleus CMS 3.70 allows HTML Injection via the index.php body parameter...

Input validation

PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI...

CVE-2018-20012

PHPCMF 4.1.3 is affected by an XSS vulnerability reachable through the first input field of index.php?s=member&c=register&m=index. The issue allows injection of script via the input and could impact users loading the page. No remediation details are provided in the supplied documents.

CVE-2018-20012: Improper Neutralization of Input During Web Page Generation

PHPCMF 4.1.3 has XSS via the first input field to the index.php?s=member&c=register&m=index URI...

CVE-2018-20006: Improper Neutralization of Input During Web Page Generation

An issue was discovered in PHPok v5.0.055. There is a Stored XSS vulnerability via the title parameter to api.php?c=post&f=save reachable via the index.php?id=book URI...

PT-2018-13663

Name of the Vulnerable Software and Affected Versions Nucleus CMS version 3.70 Description The issue allows for HTML Injection via the body parameter in index.php. Recommendations For Nucleus CMS version 3.70, avoid using the body parameter in the index.php endpoint until the issue is resolved...

CVE-2018-16636: Improper Neutralization of Input During Web Page Generation

Nucleus CMS 3.70 allows HTML Injection via the index.php body parameter...

PT-2018-15236

Name of the Vulnerable Software and Affected Versions PHPCMF version 4.1.3 Description The issue is related to a security problem where an attacker can inject malicious code. The problem occurs via the first input field to the "index.php?s=member&c=register&m=index" URI, allowing for malicious co...

Sql injection

SearchController.php in PbootCMS 1.2.1 has SQL injection via the index.php/Search/index.html query string...

CVE-2018-19893

SearchController.php in PbootCMS 1.2.1 has SQL injection via the index.php/Search/index.html query string...

PT-2018-15145

Name of the Vulnerable Software and Affected Versions PbootCMS version 1.2.1 Description The issue is related to SQL injection in the SearchController.php file of PbootCMS. This occurs via the query string in the index.php/Search/index.html endpoint. Recommendations For PbootCMS version 1.2.1,...

CVE-2018-19893: Improper Neutralization of Special Elements used in an SQL Command

SearchController.php in PbootCMS 1.2.1 has SQL injection via the index.php/Search/index.html query string...

HasanMWB 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: HasanMWB 1.0 - SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://sourceforge.net/projects/hasanmwb/ Software Link: https://netcologne.dl.sourceforge.net/project/hasanmwb/HasanMWB-v1.zip Version: 1.0 Category:...

CVE-2018-19785: Improper Neutralization of Input During Web Page Generation

PHP-Proxy through 5.1.0 has Cross-Site Scripting XSS via the URL field in index.php...

CVE-2018-19785

PHP-Proxy (up to version 5.1.0) is affected by Cross-Site Scripting via the URL field in index.php. The root cause is insufficient sanitization of the URL parameter. Documented affected component: PHP-Proxy-app/script index.php; impact: XSS. No explicit remediation or patch details are provided i...

CVE-2018-19785

PHP-Proxy through 5.1.0 has Cross-Site Scripting XSS via the URL field in index.php...

PT-2018-3688

Name of the Vulnerable Software and Affected Versions PHP-Proxy versions prior to 5.1.0 PHP-Proxy-App versions prior to 3.0 Description The issue is related to insufficient protection of the web page structure in the index.php component of the PHP-Proxy web proxy script, allowing a remote attacke...

PT-2018-15023

Name of the Vulnerable Software and Affected Versions ShowDoc version 2.4.2 Description The issue allows for a CSRF attack, which can be used to add members to a team. The affected endpoint is "server/index.php?s=/api/teamMember/save". This can potentially lead to unauthorized modifications to te...