CVE-2018-18774: Improper Neutralization of Input During Web Page Generation

CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter...

PT-2018-3061

Name of the Vulnerable Software and Affected Versions D-Link Central WiFi Manager CWM100 versions prior to v1.03R0100 BETA6 Description A SQL Injection issue was discovered in the PayAction.class.php file, specifically with the passcode parameter in the "index.php/Pay/passcodeAuth" endpoint. This...

PT-2018-14944

Name of the Vulnerable Software and Affected Versions GreenCMS version 2.3.0603 Description An issue was discovered that allows attackers to delete a log file due to a CSRF vulnerability. This can be achieved via the "index.php?m=admin&c=data&a=clear" URI. Recommendations For GreenCMS version...

CVE-2018-18773: Cross-Site Request Forgery (CSRF)

CentOS-WebPanel.com aka CWP CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password...

CVE-2018-18801

The BSEN Ordering software 1.0 has SQL Injection via student/index.php?view=view&id=SQL or index.php?q=single-item&id=SQL...

CVE-2018-18801

The BSEN Ordering software 1.0 has SQL Injection via student/index.php?view=view&id=SQL or index.php?q=single-item&id=SQL...

CVE-2018-18801: Improper Neutralization of Special Elements used in an SQL Command

The BSEN Ordering software 1.0 has SQL Injection via student/index.php?view=view&id=SQL or index.php?q=single-item&id=SQL...

CVE-2018-18795: Improper Neutralization of Special Elements used in an SQL Command

School Event Management System 1.0 has SQL Injection via the student/index.php or event/index.php id parameter...

PT-2018-14663

Name of the Vulnerable Software and Affected Versions BSEN Ordering software version 1.0 Description The issue concerns SQL Injection. It can be exploited via the index.php endpoint, specifically through the id parameter in the URLs student/index.php?view=view&id=SQL or...

PT-2018-14659

Name of the Vulnerable Software and Affected Versions School Event Management System version 1.0 Description The issue is related to SQL Injection, which can be exploited via the id parameter in the "student/index.php" or "event/index.php" API endpoints. Recommendations For School Event Managemen...

PT-2018-14909

Name of the Vulnerable Software and Affected Versions DiliCMS version 2.4.0 Description A CSRF issue allows deletion of a user or group via specific URIs, such as "admin/index.php/user/del/1" or "admin/index.php/role/del/2". Recommendations For DiliCMS version 2.4.0, as a temporary workaround,...

CVE-2018-19291: Cross-Site Request Forgery (CSRF)

An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or admin/index.php/role/del/2 URI...

Surreal ToDo 0.6.1.2 - Local File Inclusion

Surreal ToDo 0.6.1.2 - Local File Inclusion Exploit Title: Surreal ToDo 0.6.1.2 - Local File Inclusion Dork: N/A Date: 2018-11-08 Exploit Author: Ihsan Sencan Vendor Homepage: http://getsurreal.com/surrealtodo Software Link:...

CVE-2018-19192

An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the datacontent parameter...

CVE-2018-19192: Cross-Site Request Forgery (CSRF)

An issue was discovered in XiaoCms 20141229. admin/index.php?c=content&a=add&catid=3 has CSRF, as demonstrated by entering news via the datacontent parameter...

CVE-2018-19194: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in XiaoCms 20141229. /admin/index.php?c=database allows full path disclosure in a "failed to open stream" error message...

PT-2018-14852

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue was discovered in XiaoCms, where the API endpoint "admin/index.php?c=content&a=add&catid=3" is vulnerable to CSRF attacks. This can be exploited by entering news via the datacontent parameter...

PT-2018-14854

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue in XiaoCms allows full path disclosure through the "/admin/index.php?c=database" API endpoint, which returns a "failed to open stream" error message. Recommendations For XiaoCms version 20141229,...

PT-2018-14857

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue was discovered that allows arbitrary directory deletion via directory traversal in the admin/index.php endpoint, specifically through the paths variable. This is possible due to a lack of proper...

PT-2018-14856

Name of the Vulnerable Software and Affected Versions XiaoCms version 20141229 Description An issue allows remote attackers to execute arbitrary code by bypassing restrictions on uploaded file types, such as jpg, jpeg, bmp, png, and gif, using the type parameter. This can be demonstrated by...