PT-2017-11954

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7 Description The issue is related to an SQL injection vulnerability. It occurs in the dapur/apps/app article/sys article.php file through the name parameter when editing or adding a tag name. Recommendations For Fiyo CMS...

FineCMS Cross-Site Scripting Vulnerability (CNVD-2017-15545)

FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. A cross-site scripting vulnerability exists in the /application/lib/ajax/getimage.php file in FineCMS 2017-07-12 and earlier versions. A remote attacker can exploit the vulnerability to inject...

CVE-2017-11198: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in /application/lib/ajax/getimage.php in FineCMS through 2017-07-12 allows remote attackers to inject arbitrary web script or HTML via the folder, id, or name parameter...

Webmin cross-site scripting vulnerability (CNVD-2017-21737)

Webmin is a web-based system administration tool for Unix-like operating systems developed by Australian software developer Jamie Cameron and the Webmin community. A cross-site scripting vulnerability exists in versions of Webmin prior to 1.850. This vulnerability can be exploited by remote...

CVE-2017-9313

Multiple Cross-site scripting XSS vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to viewman.cgi, the referers parameter to changereferers.cgi, or the name parameter to saveuser.cgi. NOTE: these issues were not fixed in...

PT-2017-18840

Name of the Vulnerable Software and Affected Versions Webmin versions prior to 1.850 Description The issue allows remote attackers to inject arbitrary web script or HTML via specific parameters, including the sec parameter to "view man.cgi", the referers parameter to "change referers.cgi", or the...

kirkwood.edu XSS vulnerability

Vulnerable URL: http://www.kirkwood.edu/site/index.php?lastname=Bergfeldname=1/-///'/"//--...

Piwigo 'virtual_name' parameter cross-site scripting vulnerability

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time and more. A cross-site scripting vulnerability exists in Piwigo version 2.9.1. A remote attacker can exploit this vulnerability by...

Code Execution Vulnerability in FineCMS Frontend file and param parameters

FineCMS is a content management system based on PHP+MySql. A code execution vulnerability exists in the name and param parameters in the frontend of FineCMS version 5.0.7, which allows remote attackers to execute arbitrary code without logging in...

SQL Injection Vulnerability in Name Parameter of c9cms High-end Website Building System

C9CMS makes a free and open source enterprise building system. A SQL injection vulnerability exists in the name parameter of c9cms high-end website builder system. Attackers can use this vulnerability to obtain sensitive information in the database...

Code Execution Vulnerability in FineCMS Frontend name and params Parameters

FineCMS is a content management system based on PHP+MySql. A code execution vulnerability exists in the name and params parameters in the frontend of FineCMS version 5.0.6, which allows remote attackers to execute arbitrary code without logging in...

CVE-2017-7337

An improper Access Control vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to interact with unauthorized VDOMs or enumerate other ADOMs via another user's stolen session and CSRF tokens or the adomName parameter in the /fpc/sec/customer/policy/getAdomVersion...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ViMbAdmin 3.0.15 allow remote attackers to inject arbitrary web script or HTML via the 1 domain or 2 transport parameter to domain/add; the 3 name parameter to mailbox/add/did/; the 4 goto parameter to alias/add/did/; or the 5 captchatext...

CVE-2017-5870: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in ViMbAdmin 3.0.15 allow remote attackers to inject arbitrary web script or HTML via the 1 domain or 2 transport parameter to domain/add; the 3 name parameter to mailbox/add/did/ ; the 4 goto parameter to alias/add/did/ ; or the 5 captchatext...

SQL Injection Vulnerability in Eview GPS Tracking Platform System name Parameter

Eview GPS Tracking Platform System is an online tracking system from Eview. A SQL injection vulnerability exists in the name parameter of the Eview GPS Tracking Platform System, which can be exploited by attackers to obtain sensitive database information using commonly used SQL injection tools...

CVE-2017-9026

Stack buffer overflow in vshttpd aka ioos in HooToo Trip Mate 6 TM6 firmware 2.000.030 and earlier allows remote unauthenticated attackers to control the program counter via a specially crafted fname parameter of a GET request...

ourphp OP_Addname parameter has sql injection vulnerability

OurPHP 傲派建站系统 is a website content management system developed using PHP language, the developer is Harbin Weicheng Technology Co. The ourphp OPAddname parameter suffers from a sql injection vulnerability, which can be exploited to obtain sensitive data due to a lack of filtering of the parameter...

Uc365 website category navigation system adver_name parameter exists sql injection vulnerability

Uc365 website classification and navigation system is a cross-platform open source software, based on PHP + MYSQL development and construction of open source website classification and catalog management system. Uke365 website category navigation system advername parameter there is a sql injectio...

CVE-2016-2104

Multiple cross-site scripting XSS vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via 1 the label parameter to admin/BunchDetail.do; 2 the packagename, 3 searchsubscribedchannels, or 4 channelfilter parameter to software/packages/NameOverview.d...

Philips In.Sight B120/37 Cross-Site Scripting Vulnerability

The Philips In.Sight B120/37 is a video monitoring device for infants from Philips Netherlands. A cross-site scripting vulnerability exists in the Philips In.Sight B120/37. Sight B120/37 can be exploited by a remote attacker to inject arbitrary web script or HTML via the name parameter...