CVE-2021-38723

FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items...

PT-2021-10317

Name of the Vulnerable Software and Affected Versions: Dswjcms version 1.6.4 Description: A cross-site request forgery CSRF issue in the "index.php/Dswjcms/User/tfAdd" endpoint of Dswjcms allows authenticated attackers to arbitrarily add administrator users. Recommendations: For Dswjcms version...

PT-2021-10315

Name of the Vulnerable Software and Affected Versions: Dswjcms version 1.6.4 Description: A stored cross-site scripting XSS issue in the index.php/Dswjcms/Site/articleList component allows attackers to execute arbitrary web scripts or HTML. This could potentially lead to unauthorized actions on t...

PT-2021-10313

Name of the Vulnerable Software and Affected Versions: MipCMS version 5.0.1 Description: A cross-site request forgery CSRF issue allows attackers to arbitrarily add users via the "index.php?s=/user/ApiAdminUser/itemAdd" API endpoint. This enables unauthorized access to add new users...

PT-2021-10316

Name of the Vulnerable Software and Affected Versions: Dswjcms version 1.6.4 Description: An issue in the index.php/Dswjcms/Basis/resources component of Dswjcms allows attackers to execute arbitrary code via uploading a crafted PHP file. Recommendations: For Dswjcms version 1.6.4, consider...

PT-2021-22278

Name of the Vulnerable Software and Affected Versions FUEL CMS version 1.5.0 Description The issue allows SQL Injection via the parameter col in the "/fuel/index.php/fuel/logs/items" API endpoint. Recommendations For FUEL CMS version 1.5.0, avoid using the parameter col in the...

PT-2021-22276

Name of the Vulnerable Software and Affected Versions FUEL CMS version 1.5.0 Description The issue allows SQL Injection via the parameter col in the "/fuel/index.php/fuel/pages/items" API endpoint. This enables an attacker to inject malicious SQL code, potentially leading to unauthorized data...

CVE-2020-19268: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF in index.php/Dswjcms/User/tfAdd of Dswjcms 1.6.4 allows authenticated attackers to arbitrarily add administrator users...

CVE-2020-19265: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the index.php/Dswjcms/Basis/links component of Dswjcms 1.6.4 allows attackers to execute arbitrary web scripts or HTML...

CVE-2021-38723: Improper Neutralization of Special Elements used in an SQL Command

FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items...

Dropdown and scrollable Text <= 2.0 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the content parameter found in the /index.php file which allows attackers to inject arbitrary web scripts...

PT-2021-10314

Name of the Vulnerable Software and Affected Versions: Dswjcms version 1.6.4 Description: A stored cross-site scripting XSS issue in the index.php/Dswjcms/Basis/links component allows attackers to execute arbitrary web scripts or HTML. This can lead to the execution of malicious code on the...

CVE-2020-19267: Unrestricted Upload of File with Dangerous Type

An issue in index.php/Dswjcms/Basis/resources of Dswjcms 1.6.4 allows attackers to execute arbitrary code via uploading a crafted PHP file...

CVE-2020-19263: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF in MipCMS v5.0.1 allows attackers to arbitrarily escalate user privileges to administrator via index.php?s=/user/ApiAdminUser/itemEdit...

CVE-2020-19266: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the index.php/Dswjcms/Site/articleList component of Dswjcms 1.6.4 allows attackers to execute arbitrary web scripts or HTML...

PT-2021-10312

Name of the Vulnerable Software and Affected Versions: MipCMS version 5.0.1 Description: A cross-site request forgery CSRF issue allows attackers to escalate user privileges to administrator. This can be achieved via the "index.php?s=/user/ApiAdminUser/itemEdit" endpoint, by exploiting the lack o...

CVE-2021-40492

A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaScript gibbonCourseClassID, gibbonPersonID, subpage, currentDate, or allStudents to index.php...

Cross site scripting

A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaScript gibbonCourseClassID, gibbonPersonID, subpage, currentDate, or allStudents to index.php...

CVE-2021-40492: Improper Neutralization of Input During Web Page Generation

A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaScript gibbonCourseClassID, gibbonPersonID, subpage, currentDate, or allStudents to index.php...

PT-2021-22898

Name of the Vulnerable Software and Affected Versions Gibbon version 22 Description A reflected XSS issue exists in multiple pages of the Gibbon application, allowing for arbitrary execution of JavaScript. This is achieved by manipulating parameters such as gibbonCourseClassID, gibbonPersonID,...