903 matches found
PT-2019-11677
Name of the Vulnerable Software and Affected Versions ManageEngine ServiceDesk Plus version 9.3 Description The issue is related to information leakage in the "/mc login" API endpoint, allowing authenticated users to enumerate active users due to a flaw in authentication handling. This enables an...
CVE-2019-9603: Cross-Site Request Forgery (CSRF)
MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891...
PT-2019-19742
Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description The issue allows for the deletion of articles via a CSRF vulnerability in the "mc-admin/post.php" endpoint, specifically when the "state" parameter is set to "publish" and the "delete" parameter is utilized...
Sql injection
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233...
CVE-2018-20520
MiniCMS V1.10 is affected. The vulnerability is an XSS in the admin post editor: mc-admin/post-edit.php is exploitable via the query string (CVE-2018-20520) and, per related disclosures, via the content box in the editor (CVE-2019-13340). Impact per sources is to steal or access user cookies. Roo...
CVE-2018-20520
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233...
PT-2018-15412
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233...
CVE-2018-20520: Improper Neutralization of Input During Web Page Generation
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string, a related issue to CVE-2018-10296 and CVE-2018-16233...
CVE-2018-18890: Improper Limitation of a Pathname to a Restricted Directory
MiniCMS 1.10 allows full path disclosure via /mc-admin/post.php?state=delete&delete= with an invalid filename...
CVE-2018-18891: Improper Authentication
MiniCMS 1.10 allows file deletion via /mc-admin/post.php?state=delete&delete= because the authentication check occurs too late...
PT-2018-14712
Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description The issue allows for file deletion due to an authentication check occurring too late. This can be exploited via the "/mc-admin/post.php?state=delete&delete=" endpoint, where an attacker can delete files without...
PT-2018-14711
Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description The issue allows for full path disclosure through the "/mc-admin/post.php" endpoint with specific parameters, such as state set to "delete" and delete set to an invalid filename. Recommendations For MiniCMS...
MiniCMS Cross-Site Scripting Vulnerability (CNVD-2018-17188)
MiniCMS is a micro content management system designed for personal websites. A cross-site scripting vulnerability exists in MiniCMS 1.10. An attacker can exploit this vulnerability by using the mc-admin/post-edit.php tags parameter to conduct cross-site scripting attacks...
CVE-2018-16298: Improper Neutralization of Input During Web Page Generation
An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request...
PT-2018-13474
Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description An issue was discovered in MiniCMS. There is an XSS vulnerability in the 'mc-admin/post.php' endpoint for requests with a 'state' parameter set to 'delete', 'draft', or 'publish'. Recommendations For MiniCMS...
CVE-2018-16233
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter...
CVE-2018-16233
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter...
CVE-2018-16233: Improper Neutralization of Input During Web Page Generation
MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter...
PT-2018-13446
Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description The issue allows for XSS via the tags parameter in the "mc-admin/post-edit.php" endpoint. Recommendations For MiniCMS version 1.10, avoid using the tags parameter in the "mc-admin/post-edit.php" endpoint until...