CVE-2018-18075: Improper Neutralization of Special Elements used in an SQL Command

WikidForum 2.20 has SQL Injection via the rpc.php parentpostid or numrecords parameter, or the index.php?action=search selectsort parameter...

PT-2018-14360

Name of the Vulnerable Software and Affected Versions REDAXO version 5.6.3 Description The issue concerns the $opener input field variable in the addons/mediapool/pages/index.php file, which is not properly filtered and is directly output to the page. An attacker can exploit this by inserting XSS...

CVE-2018-18201: Cross-Site Request Forgery (CSRF)

qibosoft V7.0 allows CSRF via admin/index.php?lfj=member&action=addmember to add a user account...

CVE-2018-18198: Improper Neutralization of Input During Web Page Generation

The $openerinputfield variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=XSS request...

CVE-2012-6710

extfinduser in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password= aka an empty array in an action=login request to index.php...

CVE-2012-6710

The CVE-2012-6710 issue affects eXtplorer (through version 2.1.2). It allows remote attackers to bypass authentication by sending password[]= (an empty array) in an action=login request to index.php, enabling unauthorized access. Affected component is ext_find_user; root cause is authentication b...

CVE-2012-6710: Improper Authentication

extfinduser in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password= aka an empty array in an action=login request to index.php...

PT-2018-4062

Name of the Vulnerable Software and Affected Versions eXtplorer versions prior to 2.1.3 Description The issue allows remote attackers to bypass authentication. This can be achieved by sending an action=login request to "index.php" with a password variable set to an empty array. Recommendations Fo...

CVE-2018-17428

An issue was discovered in OPAC EasyWeb Five 5.7. There is SQL injection via the w2001/index.php?scelta=campi biblio parameter...

CVE-2018-17428

An issue was discovered in OPAC EasyWeb Five 5.7. There is SQL injection via the w2001/index.php?scelta=campi biblio parameter...

PT-2018-14024

Name of the Vulnerable Software and Affected Versions OPAC EasyWeb Five version 5.7 Description An issue was discovered that allows SQL injection via the "w2001/index.php?scelta=campi biblio" parameter. Recommendations For OPAC EasyWeb Five version 5.7, consider restricting access to the vulnerab...

CVE-2018-17428: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in OPAC EasyWeb Five 5.7. There is SQL injection via the w2001/index.php?scelta=campi biblio parameter...

WUZHICMS 2.0 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Title: WUZHICMS 2.0 - Cross-Site Scripting Author: Felipe "Renzi" Gabriel Vendor: http://www.wuzhicms.com Software: WUZHICMS 2.0 CVE: CVE-2018-17832 Technical Details & Description: A Cross Site Scripting vulnerability has been discovered in t...

CVE-2018-17830

The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted only values are restricted. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=&args substring...

Cross site scripting

XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter...

CVE-2018-17830

The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted only values are restricted. The attacker can insert XSS payloads via an index.php?page=mediapool/media&openerinputfield=&args substring...

CVE-2018-17832

XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter...

CVE-2018-17832

WUZHICMS 2.0 is affected by a Cross-Site Scripting (XSS) vulnerability in index.php, exploitable via the v and f GET parameters. The issue is described as XSS in the WUZHICMS 2.0 web application, with PoC references showing injected content via index.php?v= and index.php?f=. No explicit root-caus...

CVE-2018-17852

A SQL injection was discovered in WUZHI CMS 4.1.0 in coreframe/app/coupon/admin/card.php via the groupname parameter to the /index.php?m=coupon&f=card&v=detaillisting URI...

CVE-2018-17831

In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rexlist class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rexlist were used...