PT-2019-9477

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue is related to stored XSS, which can be triggered via the Extension module and specifically the SMS in station field. This field is accessible under the index.php?m=core URI, which is an API endpoin...

CVE-2018-17426: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 has stored XSS via the "Extension module" "SMS in station" field under the index.php?m=core URI...

CVE-2018-18939: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field...

PT-2018-14734

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description An issue was discovered in WUZHI CMS, where there is stored XSS in "index.php?m=core&f=index" via an ontoggle attribute to details/open/ within a second input field. Recommendations For WUZHI CMS version...

PT-2018-14735

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A stored XSS issue was discovered in the index.php file, specifically via the seventh input field when accessing the core index module, at the endpoint "index.php?m=core&f=index". Recommendations For WUZHI C...

CVE-2018-18711: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can change the super administrator's password via index.php?m=core&f=panel&v=editinfo...

PT-2018-14589

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A CSRF issue allows changing the super administrator's password via the "index.php?m=core&f=panel&v=edit info" API endpoint. Recommendations For WUZHI CMS version 4.1.0, update to a newer version that contai...

CVE-2018-16350: Improper Neutralization of Input During Web Page Generation

WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic formstatcode parameter...

PT-2018-13510

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description The issue is related to a form parameter in a specific PHP file, allowing for XSS attacks. The vulnerable parameter is statcode in the form on the page index.php?m=core&f=set&v=basic. Recommendations For WUZ...

CVE-2018-9926: Cross-Site Request Forgery (CSRF)

An issue was discovered in WUZHI CMS 4.1.0. There is a CSRF vulnerability that can add an admin account via index.php?m=core&f=power&v=add...

PT-2018-19094

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A CSRF issue was found that allows adding an admin account via the "index.php?m=core&f=power&v=add" endpoint. Recommendations For WUZHI CMS version 4.1.0, update to a newer version that contains a fix for th...

mcore-mdb.txt

M-Core Remote Password Disclosure Vulnerability Software: M-Core Download: http://aspindir.com/indir.asp?id=4412 Found by: beks Risk: Medium http://target/M-CorePath/db/uyelik.mdb...

CVE-2007-0156

M-Core stores the database under the web document root, which allows remote attackers to obtain sensitive information via a direct request to db/uyelik.mdb...

Information disclosure

M-Core stores the database under the web document root, which allows remote attackers to obtain sensitive information via a direct request to db/uyelik.mdb...

CVE-2007-0156

The CVE-2007-0156 entry concerns M-Core where the application stores its database under the web document root, enabling information disclosure if an attacker directly requests db/uyelik.mdb. Affected component: the database file accessed via the web root; root cause: improper placement of the dat...

CVE-2007-0156

M-Core stores the database under the web document root, which allows remote attackers to obtain sensitive information via a direct request to db/uyelik.mdb...

M-Core Remote Password Disclosure Vulnerability

M-Core Remote Password Disclosure Vulnerability Software: M-Core Download: http://aspindir.com/indir.asp?id=4412 Found by: beks Risk: Medium http://target/M-CorePath/db/uyelik.mdb...

CVE-2007-0156: Undefined Security Weakness

M-Core stores the database under the web document root, which allows remote attackers to obtain sensitive information via a direct request to db/uyelik.mdb...