13594 matches found
PT-2018-14448
Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM version 3.1 Description A Stored XSS issue has been found in the input and upload sections of the software. This is demonstrated by the name parameter to the "index.php/admin/client/create" URI. Recommendations For...
Ekushey Project Manager CRM 3.1 Cross Site Scripting Vulnerability
Ekushey Project Manager CRM version 3.1 suffers from a persistent cross site scripting vulnerability. Exploit Title: Ekushey Project Manager CRM 3.1 - Cross-site Scripting Exploit Author: Ismail Tasdelen Vendor Homepage: http://creativeitem.com/ Software Link : http://creativeitem.com/demo/ekushe...
CVE-2018-18374: Improper Neutralization of Input During Web Page Generation
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter...
PT-2018-14421
Name of the Vulnerable Software and Affected Versions MetInfo version 6.1.2 Description A security issue exists in the admin/index.php page of the affected software, where an XSS attack can be performed via the anyid parameter in the page. Recommendations For MetInfo version 6.1.2, avoid using th...
Design/Logic Flaw
An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml allows XSS via the name parameter, as demonstrated by a value beginning with homecontent and containing a crafted SRC attribute of an IMG element...
CVE-2018-18361
An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml allows XSS via the name parameter, as demonstrated by a value beginning with homecontent and containing a crafted SRC attribute of an IMG element...
CVE-2018-18323
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=fileeditor&file=/../ URI...
CVE-2018-18322
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php servicestart, servicerestart, servicefullstatus, or servicestop parameter...
CVE-2018-18324
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fmcurrentdir parameter, or the admin/index.php module, servicestart, servicefullstatus, servicerestart, servicestop, or file within the fileeditor parameter...
CVE-2018-18296
CVE-2018-18296 describes a cross-site scripting (XSS) vulnerability in MetInfo 6.1.2. The issue is triggered via the parameter path /admin/index.php with the bigclass parameter when the request uses n=column&a=doadd. The connected sources corroborate the same vulnerability description across mult...
PT-2018-14417
Name of the Vulnerable Software and Affected Versions nc-cms versions prior to 2017-03-10 Description An issue was discovered that allows XSS via the name parameter in the "index.php?action=edit html" endpoint. This is demonstrated by a value beginning with 'home content' and containing a crafted...
CVE-2018-18361: Improper Neutralization of Input During Web Page Generation
An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml allows XSS via the name parameter, as demonstrated by a value beginning with homecontent and containing a crafted SRC attribute of an IMG element...
CVE-2018-18317: Cross-Site Request Forgery (CSRF)
DESHANG DSCMS 1.1 has CSRF via the public/index.php/admin/admin/add.html URI...
CVE-2018-18324: Improper Neutralization of Input During Web Page Generation
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fmcurrentdir parameter, or the admin/index.php module, servicestart, servicefullstatus, servicerestart, servicestop, or file within the fileeditor parameter...
CVE-2018-18296: Improper Neutralization of Input During Web Page Generation
MetInfo 6.1.2 has XSS via the /admin/index.php bigclass parameter in an n=column&a=doadd action...
PT-2018-14401
Name of the Vulnerable Software and Affected Versions DESHANG DSCMS version 1.1 Description The issue is related to a CSRF problem. It affects the "public/index.php/admin/admin/add.html" URI. Recommendations For DESHANG DSCMS version 1.1, consider implementing proper CSRF protection mechanisms to...
CVE-2018-18322: Improper Neutralization of Special Elements used in an OS Command
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php servicestart, servicerestart, servicefullstatus, or servicestop parameter...
PT-2018-14396
Name of the Vulnerable Software and Affected Versions MetInfo version 6.1.2 Description The issue allows for XSS via the /admin/index.php endpoint with the bigclass parameter in an n=column&a=doadd action. This affects the bigclass parameter, which is used in the specified action. Recommendations...
CVE-2018-18323: Improper Limitation of a Pathname to a Restricted Directory
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has Local File Inclusion via directory traversal with an admin/index.php?module=fileeditor&file=/../ URI...
CVE-2018-18290: Improper Neutralization of Input During Web Page Generation
An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml&name=homecontent allows XSS via the HTML Source Editor. NOTE: the vendor disputes this because the form requires administrator privileges, and entering JavaScript is supported functionality...