PT-2018-14602

Name of the Vulnerable Software and Affected Versions YUNUCMS version 1.1.5 Description A cross-site scripting XSS issue was found in the "index.php/admin/category/editcategory?id=73" API endpoint. This issue affects the ability to securely manage categories. Recommendations For YUNUCMS version...

CVE-2018-18705

PhpTpoint Hospital Management System (PHP) contains multiple SQL injection vulnerabilities reachable via index.php (user parameter in LOGIN.php) and via rno parameters to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php. Exploitation could allow bypassing login to obtain database information or exe...

CVE-2018-18704

PhpTpoint Pharmacy Management System suffers from a SQL injection vulnerability in the index.php username parameter...

PT-2018-14583

Name of the Vulnerable Software and Affected Versions PhpTpoint hospital management system affected versions not specified Description The issue concerns SQL injection vulnerabilities. These vulnerabilities can be exploited via the user parameter in index.php associated with LOGIN.php, or the rno...

CVE-2018-18711: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=editinfo...

CVE-2018-18704: Improper Neutralization of Special Elements used in an SQL Command

PhpTpoint Pharmacy Management System suffers from a SQL injection vulnerability in the index.php username parameter...

CVE-2018-18705: Improper Neutralization of Special Elements used in an SQL Command

PhpTpoint hospital management system suffers from multiple SQL injection vulnerabilities via the index.php user parameter associated with LOGIN.php, or the rno parameter to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php...

CVE-2018-18712: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's username via index.php?m=member&f=index&v=edit&uid=1...

PT-2018-14589

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A CSRF issue allows changing the super administrator's password via the "index.php?m=core&f=panel&v=edit info" API endpoint. Recommendations For WUZHI CMS version 4.1.0, update to a newer version that contai...

PT-2018-14590

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A CSRF issue allows changing the super administrator's username via the "index.php?m=member&f=index&v=edit&uid=1" endpoint, specifically targeting the uid variable set to 1, which corresponds to the super...

PT-2018-14582

Name of the Vulnerable Software and Affected Versions PhpTpoint Pharmacy Management System affected versions not specified Description The issue is related to a SQL injection vulnerability. It affects the username parameter in the "index.php" endpoint. Recommendations At the moment, there is no...

CVE-2018-18694: Improper Neutralization of Input During Web Page Generation

admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases...

PT-2018-14575

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns stored XSS that can be triggered by remote authenticated administrators. This occurs when a file without an extension is uploaded, and in certain cases, this file is interpreted as...

CVE-2018-18622

CVE-2018-18622 affects Waimai Super Cms 20150505. The issue is a Cross-Site Scripting (XSS) vulnerability exploitable through the username parameter in index.php?m=public&a=doregister, as reported by multiple sources (Red Hat, CNVD, NVD). Root cause is unsanitized input that allows injection of s...

CVE-2018-18622: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Waimai Super Cms 20150505. There is XSS via the index.php?m=public&a=doregister username parameter...

PT-2018-14544

Name of the Vulnerable Software and Affected Versions Waimai Super Cms version 20150505 Description An issue was discovered that allows for XSS via the "index.php?m=public&a=doregister" endpoint, specifically through the username parameter. Recommendations For Waimai Super Cms version 20150505,...

CVE-2018-18626: Undefined Security Weakness

An issue was discovered in PHPYun V4.6. There is a vulnerability that can delete any file or directory via the "admin/index.php?m=database&c=del" sql parameter because delaction in admin/model/database.class.php mishandles this parameter...

CVE-2018-18417

In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI...

CVE-2018-18417

In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI...

CVE-2018-18417: Improper Neutralization of Input During Web Page Generation

In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI...