13595 matches found
juwelier-petersen.de XSS vulnerability
Open Bug Bounty ID: OBB-620002 Description| Value ---|--- Affected Website:| juwelier-petersen.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2018-11092
An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table aka Clear Table action...
CVE-2018-11092: Cross-Site Request Forgery (CSRF)
An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table aka Clear Table action...
PT-2018-10303
Name of the Vulnerable Software and Affected Versions MyBB Admin Notes plugin version 1.1 Description An issue allows an attacker to remotely delete all admin notes. This can be achieved via the "admin/index.php?empty=table" action, which is vulnerable to CSRF. Recommendations For MyBB Admin Note...
forum-tc.msi.com Open Redirect vulnerability
Open Bug Bounty ID: OBB-617657 Description| Value ---|--- Affected Website:| forum-tc.msi.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...
PT-2018-10120
Name of the Vulnerable Software and Affected Versions LiveZilla Live Chat versions prior to 7.0.9.5 Description The issue affects the chat/mobile/index.php file in LiveZilla Live Chat, where a Cross-Site Scripting vulnerability can be exploited via the Accept-Language HTTP header. Recommendations...
CVE-2018-10810: Improper Neutralization of Input During Web Page Generation
chat/mobile/index.php in LiveZilla Live Chat 7.0.9.5 and prior is affected by Cross-Site Scripting via the Accept-Language HTTP header...
WUZHI CMS 4.1.0 - tag[pinyin] Cross-Site Scripting
WUZHI CMS 4.1.0 - tagpinyin Cross-Site Scripting Exploit Title: WUZHI CMS 4.1.0 XSS Vulnerability Date: 2018-4-23 Exploit Author: jiguang [email protected] Vendor Homepage: https://github.com/wuzhicms/wuzhicms Software Link: https://github.com/wuzhicms/wuzhicms Version: 4.1.0 CVE: CVE-2018-10311 An...
PT-2018-10236
Name of the Vulnerable Software and Affected Versions YXcms version 1.4.7 Description A cross-site request forgery issue allows remote attackers to delete administrator accounts. The issue is related to the "index.php?r=admin/admin/admindel" endpoint, specifically in the...
CVE-2018-11003: Cross-Site Request Forgery (CSRF)
An issue was discovered in YXcms 1.4.7. Cross-site request forgery CSRF vulnerability in protected/apps/admin/controller/adminController.php allows remote attackers to delete administrator accounts via index.php?r=admin/admin/admindel...
nordichem.eu XSS vulnerability
Open Bug Bounty ID: OBB-615179 Description| Value ---|--- Affected Website:| nordichem.eu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
thinkphp SQL Injection Vulnerability (CNVD-2018-09389)
thinkphp is a set of open source, PHP-based lightweight web application development framework. A SQL injection vulnerability exists in thinkphp version 3.1.3. A remote attacker can use the 's' parameter to send a specially crafted SQL statement to the index.php file to exploit the vulnerability t...
CVE-2015-1503: Improper Limitation of a Pathname to a Restricted Directory
Multiple directory traversal vulnerabilities in IceWarp Mail Server before 11.2 allow remote attackers to read arbitrary files via a 1 .. dot dot in the file parameter to a webmail/client/skins/default/css/css.php page or .../. dot dot dot slash dot in the 2 script or 3 style parameter to...
CVE-2018-10686
An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $REQUEST'path' to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a fileputcontents call in web/upload/UploadHandler.php...
CVE-2018-10686: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $REQUEST'path' to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a fileputcontents call in web/upload/UploadHandler.php...
PT-2018-10053
Name of the Vulnerable Software and Affected Versions Vesta Control Panel version 0.9.8-20 Description An issue was discovered that allows for Reflected XSS via the path variable in the view/file/index.php URI. This can potentially lead to remote PHP code execution through vectors involving a fil...
malfong.is XSS vulnerability
Open Bug Bounty ID: OBB-612518 Description| Value ---|--- Affected Website:| malfong.is Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
CVE-2018-10570
Frog CMS 0.9.5 has XSS in /install/index.php via the 'config''adminusername' field...
PT-2018-9958
Name of the Vulnerable Software and Affected Versions: Nagios XI version 5.4.13 Description: A security issue was found that allows a registered user to use directory traversal to read local files. This can be achieved by using specific URIs, such as those beginning with "index.php?xiwindow=./" a...
CVE-2018-10553: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in Nagios XI 5.4.13. A registered user is able to use directory traversal to read local files, as demonstrated by URIs beginning with index.php?xiwindow=./ and config/?xiwindow=../ substrings...