49 matches found
CVE-2020-23631
CVE-2020-23631 affects WDJA CMS 1.5, where a flaw in admin/global/manage.php allows CSRF that can enable cross-site scripting via the tongji parameter. The impact described is XSS; no exploitation details or patch/version remediation are provided in the supplied documents. If present, mitigation ...
CVE-2019-1010152
zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/manage.php line 31-80...
CVE-2018-17429
/console/account/manage.php?type=action&action=add in JTBC v3.0C has CSRF for adding an administrator account...
CVE-2019-7738
C.P.Sub before 5.3 allows CSRF via a manage.php?p=articledel&id= URI...
CVE-2019-7738
CVE-2019-7738 affects C.P.Sub prior to version 5.3 and is a CSRF vulnerability exploitable via a manage.php?p=article_del&id= URI. The issue is described consistently across multiple sources (NVD and related records) as a CSRF in the article deletion path. The documents do not provide concrete ex...
CVE-2018-19546
JTBCPHP 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter...
Code injection
JTBCPHP 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter...
CVE-2018-19546
JTBCPHP 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter...
CVE-2018-19547
JTBCPHP 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter...
CVE-2018-19547
CVE-2018-19547 affects JTBC(PHP) 3.0.1.7 with a reflected/stored XSS in the console/xml/manage.php?type=action&action=edit content parameter. The root cause is an improper handling of the content parameter in that endpoint, enabling injection of arbitrary JavaScript/HTML. The connected documents ...
CVE-2018-19327
An issue was discovered in JTBCPHP 3.0.1.7. aboutus/manage.php?type=action&action=add allows CSRF...
Code injection
An issue was discovered in JTBCPHP 3.0.1.6. Arbitrary file read operations are possible via a /console//console/file/manage.php?type=list&path=c:/ substring...
CVE-2018-14962
zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php...
CVE-2018-14962
zzcms 8.3 has stored XSS related to the content variable in user/manage.php and zt/show.php...
CVE-2018-14962
The CVE-2018-14962 entry concerns zzcms 8.3 with a stored XSS vulnerability affecting the content variable in user/manage.php and zt/show.php. Affected component/file paths are specified, and the underlying issue is a stored XSS condition, enabling injection via the content field. The available d...
dres.chc.edu.tw XSS vulnerability
Open Bug Bounty ID: OBB-591604 Description| Value ---|--- Affected Website:| dres.chc.edu.tw Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Command injection
1 wp-dbmanager.php and 2 database-manage.php in the WP-DBManager aka Database Manager plugin before 2.7.2 for WordPress place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process...
PHPWind 8.3 /apps/group/admin/manage.php SQL注入漏洞
No description provided by source...
Connections <= 8.5.8 - Reflected Cross-Site Scripting (XSS)
Line 320 contains unfiltered user input for the search field being sent directly via echo back to the users browser via the ’s’ variable. In file includes/admin/pages/manage.php Line 320:...