114 matches found
CVE-2019-8433: Unrestricted Upload of File with Dangerous Type
JTBCPHP 3.0.1.8 allows Arbitrary File Upload via the console//console/file/manage.php?type=list URI, as demonstrated by a .php file...
PT-2019-19033
Name of the Vulnerable Software and Affected Versions JTBCPHP version 3.0.1.8 Description The issue allows for Arbitrary File Upload. This can be achieved via the "/console//console/file/manage.php?type=list" API endpoint. An example of exploitation includes uploading a .php file. Recommendations...
CVE-2019-7738
C.P.Sub before 5.3 allows CSRF via a manage.php?p=articledel&id= URI...
CVE-2019-7738
C.P.Sub before 5.3 allows CSRF via a manage.php?p=articledel&id= URI...
CVE-2019-7738
CVE-2019-7738 affects C.P.Sub prior to version 5.3 and is a CSRF vulnerability exploitable via a manage.php?p=article_del&id= URI. The issue is described consistently across multiple sources (NVD and related records) as a CSRF in the article deletion path. The documents do not provide concrete ex...
CVE-2019-7738: Cross-Site Request Forgery (CSRF)
C.P.Sub before 5.3 allows CSRF via a manage.php?p=articledel&id= URI...
PT-2019-18732
Name of the Vulnerable Software and Affected Versions C.P.Sub versions prior to 5.3 Description The issue allows for CSRF attacks. This can be achieved via a "manage.php?p=article del&id=" URI. Recommendations For versions prior to 5.3, update to version 5.3 or later to resolve the issue...
CVE-2018-19546
JTBCPHP 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter...
Code injection
JTBCPHP 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter...
CVE-2018-19546
JTBCPHP 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter...
CVE-2018-19547
JTBCPHP 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter...
CVE-2018-19547
CVE-2018-19547 affects JTBC(PHP) 3.0.1.7 with a reflected/stored XSS in the console/xml/manage.php?type=action&action=edit content parameter. The root cause is an improper handling of the content parameter in that endpoint, enabling injection of arbitrary JavaScript/HTML. The connected documents ...
CVE-2018-19546: Improper Neutralization of Input During Web Page Generation
JTBCPHP 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter...
CVE-2018-19547: Improper Neutralization of Input During Web Page Generation
JTBCPHP 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter...
PT-2018-14991
Name of the Vulnerable Software and Affected Versions JTBCPHP version 3.0.1.7 Description The issue concerns a CSRF vulnerability that can be exploited via the "console/xml/manage.php?type=action&action=edit" URI. It is demonstrated by an XSS payload in the content parameter. Recommendations For...
PT-2018-14992
Name of the Vulnerable Software and Affected Versions JTBCPHP version 3.0.1.7 Description The issue is related to a cross-site scripting XSS problem. It occurs via the "console/xml/manage.php" API endpoint, specifically when the type parameter is set to "action" and the action parameter is set to...
CVE-2018-19327
An issue was discovered in JTBCPHP 3.0.1.7. aboutus/manage.php?type=action&action=add allows CSRF...
CVE-2018-19327: Cross-Site Request Forgery (CSRF)
An issue was discovered in JTBCPHP 3.0.1.7. aboutus/manage.php?type=action&action=add allows CSRF...
PT-2018-14917
Name of the Vulnerable Software and Affected Versions JTBCPHP version 3.0.1.7 Description An issue was discovered that allows CSRF in the "aboutus/manage.php" endpoint, specifically when the "type" parameter is set to "action" and the "action" parameter is set to "add". Recommendations For JTBCPH...