114 matches found
Information Disclosure
moodle/moodle is vulnerable to information exposure. The vulnerability exists due to a lack of sanitization in output field in the manage.php file, allowing to read sensitive information in the system...
PT-2022-16757
Name of the Vulnerable Software and Affected Versions Luocms version 2.0 Description The issue is related to incorrect access control. An attacker can exploit this by writing an arbitrary shell file through the "/admin/templates/template manage.php" API endpoint. Recommendations For Luocms versio...
Arbitrary file deletion
WDJA CMS v1.5.2 contains an arbitrary file deletion vulnerability in the component admin/cache/manage.php...
CVE-2020-21648
CVE-2020-21648 affects WDJA CMS v1.5.2 with an arbitrary file deletion vulnerability in admin/cache/manage.php. The issue is documented across multiple sources (NVD/Red Hat/CVE). The root cause details are not provided beyond the vulnerability location; impact is deletion of arbitrary files. CVSS...
PT-2021-10648
Name of the Vulnerable Software and Affected Versions: WDJA CMS version 1.5.2 Description: The issue is related to an arbitrary file deletion vulnerability. It affects the component admin/cache/manage.php. Recommendations: For WDJA CMS version 1.5.2, consider restricting access to the...
CVE-2020-21648: Undefined Security Weakness
WDJA CMS v1.5.2 contains an arbitrary file deletion vulnerability in the component admin/cache/manage.php...
Nagios XI Manage.php Directory Traversal (CVE-2021-3277)
A directory traversal vulnerability exists in Nagios XI. The vulnerability is due to insufficient validation of the request parameters in manage.php of the Custom-includes module...
CVE-2020-35973: Improper Neutralization of Input During Web Page Generation
An issue was discovered in zzcms2020. There is a XSS vulnerability that can insert and execute JS code arbitrarily via /user/manage.php...
PT-2021-11889
Name of the Vulnerable Software and Affected Versions: zzcms2020 affected versions not specified Description: The issue is related to a XSS vulnerability that allows arbitrary insertion and execution of JS code via the /user/manage.php endpoint. Recommendations: At the moment, there is no...
CVE-2020-23631
CVE-2020-23631 affects WDJA CMS 1.5, where a flaw in admin/global/manage.php allows CSRF that can enable cross-site scripting via the tongji parameter. The impact described is XSS; no exploitation details or patch/version remediation are provided in the supplied documents. If present, mitigation ...
CVE-2020-23631
Cross-site request forgery CSRF in admin/global/manage.php in WDJA CMS 1.5 allows remote attackers to conduct cross-site scripting XSS attacks via the tongji parameter...
CVE-2020-23631: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF in admin/global/manage.php in WDJA CMS 1.5 allows remote attackers to conduct cross-site scripting XSS attacks via the tongji parameter...
PT-2021-10919
Name of the Vulnerable Software and Affected Versions WDJA CMS version 1.5 Description The issue allows remote attackers to conduct cross-site scripting XSS attacks. This is achieved through a cross-site request forgery CSRF in the admin/global/manage.php file via the tongji parameter...
CVE-2019-1010152
zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/manage.php line 31-80...
PT-2019-11483
Name of the Vulnerable Software and Affected Versions: zzcms versions 8.3 and earlier Description: The issue affects the user/manage.php component, specifically lines 31-80, and can lead to code execution through file deletion, resulting in a potential getshell impact. Recommendations: For zzcms...
CVE-2019-1010152: Missing Authorization
zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: user/manage.php line 31-80...
PT-2019-19786
Name of the Vulnerable Software and Affected Versions JTBCPHP version 3.0.1.8 Description A flaw was found in the cache management module, allowing an arbitrary file ending in "inc.php" to be deleted. This can be achieved by accessing the console/cache/manage.php endpoint with specific parameters...
CVE-2018-17429
/console/account/manage.php?type=action&action=add in JTBC v3.0C has CSRF for adding an administrator account...
PT-2019-9478
Name of the Vulnerable Software and Affected Versions JTBC version 3.0 Description The issue concerns a CSRF flaw in the "/console/account/manage.php" endpoint, specifically when the "type" parameter is set to "action" and the "action" parameter is set to "add". This allows for the addition of an...