CVE-2018-13038

OpenSID 18.06-pasca has an Unrestricted File Upload vulnerability via an Attachment Document in the article feature. This vulnerability leads to uploading arbitrary PHP code via a .php filename with the application/pdf Content-Type...

CVE-2018-13039

OpenSID 18.06-pasca is affected by CVE-2018-13039: a reflected Cross Site Scripting (XSS) vulnerability in the cari parameter, exploitable via index.php/first?cari=. CNVD/CNVD-2018-13871, NVD CVE-2018-13039 and related records describe that a remote attacker can inject script/HTML to access user ...

CVE-2018-13038

OpenSID 18.06-pasca has an Unrestricted File Upload vulnerability in the article feature’s Attachment Document, allowing an attacker to upload arbitrary PHP code using a .php filename with Content-Type: application/pdf. Root cause is unrestricted file upload in the attachment workflow; impact is ...

CVE-2018-13040

OpenSID 18.06-pasca has a CSRF vulnerability. This vulnerability can add an account at the admin level via the index.php/manuser/insert URI...

PT-2018-11552

Name of the Vulnerable Software and Affected Versions OpenSID version 18.06-pasca Description The issue allows for an Unrestricted File Upload via an Attachment Document in the article feature. This leads to uploading arbitrary PHP code by using a .php filename with the application/pdf...

CVE-2018-13038: Unrestricted Upload of File with Dangerous Type

OpenSID 18.06-pasca has an Unrestricted File Upload vulnerability via an Attachment Document in the article feature. This vulnerability leads to uploading arbitrary PHP code via a .php filename with the application/pdf Content-Type...

CVE-2018-13040: Cross-Site Request Forgery (CSRF)

OpenSID 18.06-pasca has a CSRF vulnerability. This vulnerability can add an account at the admin level via the index.php/manuser/insert URI...

PT-2018-11554

Name of the Vulnerable Software and Affected Versions OpenSID version 18.06-pasca Description The issue allows an attacker to add an account at the admin level. This is achieved via the "index.php/man user/insert" API endpoint. Recommendations For OpenSID version 18.06-pasca, consider restricting...

PT-2018-11553

Name of the Vulnerable Software and Affected Versions OpenSID version 18.06-pasca Description The issue is related to reflected Cross Site Scripting XSS that can be triggered via the cari parameter in an index.php/first?cari= URI. This allows for potential malicious script injection...

CVE-2018-13039: Improper Neutralization of Input During Web Page Generation

OpenSID 18.06-pasca has reflected Cross Site Scripting XSS via the cari parameter, aka an index.php/first?cari= URI...