PT-2019-19035

Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description The issue is related to an XSS vulnerability via the HTTP Host header in the admin/default.php file. Recommendations For PHPMyWind version 5.5, update the software to a version that includes a fix for this...

CVE-2019-7402

An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfgqqcode parameter. This can be exploited via CSRF...

CVE-2019-7402

An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfgqqcode parameter. This can be exploited via CSRF...

CVE-2019-7403

An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/databasebackup.php?action=import&dopost=deldir&tbname=../ URI...

Code injection

An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/databasebackup.php?action=import&dopost=deldir&tbname=../ URI...

CVE-2019-7403

An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/databasebackup.php?action=import&dopost=deldir&tbname=../ URI...

Cross site request forgery (csrf)

An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfgqqcode parameter. This can be exploited via CSRF...

CVE-2019-7402

An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfgqqcode parameter. This can be exploited via CSRF...

CVE-2019-7403

An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/databasebackup.php?action=import&dopost=deldir&tbname=../ URI...

CVE-2019-7402

The vulnerability CVE-2019-7402 affects PHPMyWind 5.5, where the GetQQ function in include/func.class.php allows XSS via the cfg_qqcode parameter. The issue can be exploited through CSRF. Connected sources (Red Hat) corroborate the same description. No specific vulnerable versions beyond 5.5 are ...

CVE-2019-7403

PHPMyWind 5.5 is affected by CVE-2019-7403 due to an unsafely handled tbname parameter in admin/database_backup.php, allowing remote attackers to delete arbitrary folders via action=deldir and deldir path traversal. Impact is described as potential folder deletion with unauthenticated or limited-...

PT-2019-18583

Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description An issue was discovered that allows XSS via the cfg qqcode parameter in the GetQQ function, which can be exploited via CSRF. Recommendations For PHPMyWind version 5.5, consider disabling the GetQQ function in...

PT-2019-18584

Name of the Vulnerable Software and Affected Versions PHPMyWind version 5.5 Description An issue in PHPMyWind allows remote attackers to delete arbitrary folders. This is achieved through the "admin/database backup.php" API endpoint with specific parameters, including action=import, dopost=deldir...

CVE-2019-7402: Improper Neutralization of Input During Web Page Generation

An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfgqqcode parameter. This can be exploited via CSRF...

CVE-2019-7403: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in PHPMyWind 5.5. It allows remote attackers to delete arbitrary folders via an admin/databasebackup.php?action=import&dopost=deldir&tbname=../ URI...

SQL injection vulnerability in PHPMyWind di***_up***.php file

PHPMyWind is a PHP + MySQL based development of W3C standards-compliant site building engine . A SQL injection vulnerability exists in the PHPMyWind diup.php file. An attacker can exploit this vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in PHPMyWind we***_up***.php File

PPMyWind is a PHP + MySQL based development of W3C-compliant building engine . A SQL injection vulnerability exists in the PHPMyWind weup.php file. An attacker can exploit this vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in PHPMyWind si***_up***.php File

PHPMyWind is a PHP + MySQL based development of W3C standards-compliant site building engine . A SQL injection vulnerability exists in the PHPMyWind siup.php file. An attacker can exploit this vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in PHPMyWind mes***_up***.php File

PHPMyWind is a PHP + MySQL based development of W3C standards-compliant site building engine . A SQL injection vulnerability exists in the PHPMyWind mesup.php file. An attacker can exploit this vulnerability to obtain sensitive database information...

SQL Injection Vulnerability in PHPMyWind jo***_up***.php File

PHPMyWind is a PHP + MySQL based development of W3C standards-compliant site building engine . A SQL injection vulnerability exists in the PHPMyWind joup.php file. An attacker can exploit this vulnerability to obtain sensitive database information...