HackerOne: Open redirect vulnerability in index.php

Summary: Hello Team i would like to report an open redirect on hackerone.com with reference to report 320376. In report 320376 it shows vulnerability i mitigated but still i am able to reproduce it. so all the summary and description remains the same. Redirection is performed by HackerOne website...

PT-2018-14841

Name of the Vulnerable Software and Affected Versions YUNUCMS version 1.1.5 Description The issue allows remote attackers to execute arbitrary PHP code. This can be achieved by placing the code in the DB PREFIX field, which is then written to database.php, when the index.php?s=index/install/setup...

CVE-2018-19138

WSTMart 2.0.7 has CSRF via the index.php/admin/staffs/add.html URI...

PT-2018-14829

Name of the Vulnerable Software and Affected Versions WSTMart version 2.0.7 Description The issue is related to a CSRF problem. It affects the index.php/admin/staffs/add.html API endpoint. Recommendations For version 2.0.7, consider implementing proper CSRF protection mechanisms to prevent...

CVE-2018-19138: Cross-Site Request Forgery (CSRF)

WSTMart 2.0.7 has CSRF via the index.php/admin/staffs/add.html URI...

CVE-2018-19104: Cross-Site Request Forgery (CSRF)

In BageCMS 3.1.3, upload/index.php has a CSRF vulnerability that can be used to upload arbitrary files and get server privileges...

PT-2018-14806

Name of the Vulnerable Software and Affected Versions BageCMS version 3.1.3 Description The issue allows for the upload of arbitrary files, potentially leading to server privileges. This is due to a CSRF vulnerability in the upload/index.php file. Recommendations For BageCMS version 3.1.3, consid...

CVE-2018-19051

MetInfo 6.1.3 is affected by a cross-site scripting (XSS) vulnerability exploitable through the admin/index.php?a=dogetpassword abt_type parameter. The issue is tied to MetInfo’s admin input handling, enabling XSS in the context of the injected parameter. Connected sources consistently reference ...

CVE-2018-19050

MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter...

CVE-2018-19050: Improper Neutralization of Input During Web Page Generation

MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter...

CVE-2018-19051: Improper Neutralization of Input During Web Page Generation

MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abttype parameter...

PT-2018-14768

Name of the Vulnerable Software and Affected Versions MetInfo version 6.1.3 Description The issue is related to a Cross-Site Scripting XSS problem. It occurs via the langset parameter in the "admin/index.php?a=dogetpassword" endpoint. Recommendations For MetInfo version 6.1.3, update the software...

PT-2018-14769

Name of the Vulnerable Software and Affected Versions MetInfo version 6.1.3 Description The issue is related to a security problem where an attacker can inject malicious code. The problem is exploited through the abt type parameter in the "admin/index.php?a=dogetpassword" endpoint. Recommendation...

CVE-2018-18939

An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field...

CVE-2018-18939

An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field...

CVE-2018-18938

An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input field...

Cross site scripting

An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input field...

CVE-2018-18939

An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field...

CVE-2018-18938: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input field...

CVE-2018-18939: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field...