PT-2018-9972

Name of the Vulnerable Software and Affected Versions: BigTree versions 4.2.22 and earlier Description: The issue allows remote attackers to upload and execute arbitrary PHP code. This is because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess...

PT-2018-9968

Name of the Vulnerable Software and Affected Versions: Frog CMS version 0.9.5 Description: The issue concerns a security problem where an attacker can inject malicious code. The estimated number of potentially affected devices is not provided. The problem can be exploited through the...

CVE-2018-10570: Improper Neutralization of Input During Web Page Generation

Frog CMS 0.9.5 has XSS in /install/index.php via the 'config''adminusername' field...

Cross site request forgery (csrf)

An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...

CVE-2018-10503

An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...

CVE-2018-10503: Cross-Site Request Forgery (CSRF)

An issue was discovered in index.php in baijiacms V4 v41420170105. CSRF allows adding an administrator account via op=edituser, changing the administrator password via op=changepwd, or deleting an account via op=deleteuser...

PT-2018-9924

Name of the Vulnerable Software and Affected Versions: baijiacms V4 version v4 1 4 20170105 Description: An issue in index.php allows for CSRF attacks, enabling unauthorized actions such as adding an administrator account via "op=edituser", changing the administrator password via "op=changepwd", ...

CVE-2018-10430

An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...

CVE-2018-10391

An issue was discovered in WUZHI CMS 4.1.0. There is XSS via the email parameter to the index.php?m=member&v=register URI...

CVE-2018-10391: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WUZHI CMS 4.1.0. There is XSS via the email parameter to the index.php?m=member&v=register URI...

CVE-2018-10430: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DiliCMS aka DiligentCMS 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of "System setting-site setting" of admin/index.php...

PT-2018-9882

Name of the Vulnerable Software and Affected Versions: DiliCMS version 2.4.0 Description: A Stored XSS issue was found in the fourth textbox of "System setting-site setting" in admin/index.php, allowing for potential exploitation. Recommendations: For DiliCMS version 2.4.0, consider restricting...

PT-2018-17606

Name of the Vulnerable Software and Affected Versions Composr CMS version 10.0.13 Description The issue concerns a security problem where an attacker can inject malicious code. This is achieved by manipulating the site name parameter in a specific request to the '/adminzone/index.php' API endpoin...

CVE-2018-10374

EasyCMS 1.3 is affected by a Cross‑Site Scripting (XSS) vulnerability in the s POST parameter (the value of the search box) sent to index.php?s=/index/search/index.html. The issue arises from XSS in that parameter, enabling injection of arbitrary script/HTML. This CVE entry corresponds to EasyCMS...

CVE-2018-10374

EasyCMS 1.3 has XSS via the s POST parameter aka a search box value in an index.php?s=/index/search/index.html request...

PT-2018-9856

Name of the Vulnerable Software and Affected Versions: EasyCMS version 1.3 Description: The issue allows for XSS via the s POST parameter in an "index.php?s=/index/search/index.html" request. This is related to a search box value. Recommendations: For EasyCMS version 1.3, consider restricting the...

CVE-2018-10374: Improper Neutralization of Input During Web Page Generation

EasyCMS 1.3 has XSS via the s POST parameter aka a search box value in an index.php?s=/index/search/index.html request...

CVE-2018-10329

app/tools/mac-lookup/index.php in phpIPAM 1.3.1 has Reflected XSS on /tools/mac-lookup/ via the mac parameter...

CVE-2018-10311

A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the tagpinyin parameter to the /index.php?m=tags&f=index&v=add URI...

Cross site scripting

A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the tagpinyin parameter to the /index.php?m=tags&f=index&v=add URI...