3541 matches found
CVE-2020-5305
CVE-2020-5305 affects Codoforum 4.8.3, exposing a cross‑site scripting (XSS) vulnerability in the admin dashboard via the name field when creating a new user on the Manage Users screen. Public sources consistently describe the issue as a lack of proper validation of client‑side data, enabling inj...
CVE-2020-5305
Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen...
MFScripts YetiShare SQL Injection Vulnerability
Mellow Fish YetiShare is a PHP-based file hosting web system script from Mellow Fish UK. A SQL injection vulnerability exists in the translationmanagetext.ajax.php and multiple manage.ajax.php files in Mellow Fish YetiShare versions 3.5.2 through 4.5.3. The vulnerability stems from a lack of...
CVE-2019-19984
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed users with editpost capabilities to manage plugin settings and email campaigns...
AUO SunVeillance Monitoring System Code Issue Vulnerabilities
AUO SunVeillance Monitoring System is an intelligent cloud-based PV monitoring solution from AUO Taiwan. AUO SunVeillance Monitoring System v1.1.9e is vulnerable to a code issue in the PictureManagemvc.aspx file. An attacker can exploit this vulnerability to upload files via modified authorizatio...
Cross-site Scripting(XSS)
lavalite/cms is vulnerable to cross-site scripting XSS attack. The attack is possible when a user with admin access privilege can enter arbitrary post requests through the account name in the Manage Clients screen...
CVE-2019-17434
LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen...
Cross site scripting
LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen...
CVE-2019-17434
LavaLite CMS ≤ 5.7 is affected by a cross-site scripting (XSS) vulnerability triggered by a crafted account name on the Manage Clients screen. The root cause is mishandling/validation of client-side data in the web application (CVE-2019-17434). Some sources indicate exploitation may require admin...
Design/Logic Flaw
REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values...
CVE-2019-17121
REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values...
dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes
A flaw was found in dovecot. IMAP and ManageSieve protocol parsers do not properly handle the NULL byte when scanning data in quoted strings which leads to an out of bounds heap memory write. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...
CVE-2019-16659
TuziCMS 2.0.6 has index.php/manage/link/doadd CSRF...
CVE-2019-16659
TuziCMS 2.0.6 has index.php/manage/link/doadd CSRF...
CVE-2019-16658
TuziCMS 2.0.6 has index.php/manage/notice/doadd CSRF...
Cross site request forgery (csrf)
TuziCMS 2.0.6 has index.php/manage/notice/doadd CSRF...
Cross site request forgery (csrf)
TuziCMS 2.0.6 has index.php/manage/link/doadd CSRF...
CVE-2019-16658
TuziCMS 2.0.6 is affected by a CSRF vulnerability in the endpoint index.php/manage/notice/do_add . The provided documents identify the root cause as a CSRF issue at that endpoint. No exploitation specifics or remediation steps are given in the sources. If present, check for interim mitigations; o...
CVE-2019-16659
The connected sources confirm CVE-2019-16659 affects TuziCMS 2.0.6, describing a CSRF issue in index.php/manage/link/do_add. The root cause is a Cross-Site Request Forgery vulnerability in that endpoint, enabling unauthorized state-changing requests from a logged-in user. Exploit details, affecte...