CVE-2022-28524: Improper Neutralization of Special Elements used in an SQL Command

ED01-CMS v20180505 was discovered to contain a SQL injection vulnerability via the component post.php...

PT-2022-19064

Name of the Vulnerable Software and Affected Versions ED01-CMS version v20180505 Description A SQL injection issue was discovered in the post.php component. This allows for potential exploitation. Recommendations For ED01-CMS version v20180505, consider restricting access to the post.php componen...

PT-2022-18387

Name of the Vulnerable Software and Affected Versions Social Codia SMS version 1 Description The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field in add post.php. This enables the execution of malicious code, potentially...

PT-2022-18200

Name of the Vulnerable Software and Affected Versions AeroCMS version 0.0.1 Description The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field in add post.php. This enables the execution of malicious code on the web...

PT-2022-16543

Name of the Vulnerable Software and Affected Versions eliteCMS version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the "/admin/edit post.php" API endpoint. Recommendations For eliteCMS version 1.0, as a temporary workaround,...

PT-2022-7046

Name of the Vulnerable Software and Affected Versions Popup Builder WordPress plugin versions prior to 4.0.7 Description The issue is related to the lack of protection against SQL query structure exploitation when handling orderby and order parameters in the admin-post.php script of the Popup...

CVE-2020-20943: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arbitrarily publishing new articles via a crafted URL...

PT-2021-10555

Name of the Vulnerable Software and Affected Versions: Qibosoft version 7 Description: A Cross-Site Request Forgery CSRF issue exists in the /member/post.php?job=postnew&step=post endpoint of the affected software, allowing attackers to force victim users into publishing new articles via a crafte...

PT-2021-16455

Name of the Vulnerable Software and Affected Versions: Victor CMS version 1.0 Description: The issue allows attackers to execute arbitrary code via the file upload to the /admin/includes/admin add post.php endpoint. This is due to an arbitrary file upload vulnerability. Recommendations: For Victo...

CVE-2020-35749

Directory traversal vulnerability in class-simplejobboardresumedownloadhandler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjbfile parameter to wp-admin/post.php...

CVE-2020-35749: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in class-simplejobboardresumedownloadhandler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjbfile parameter to wp-admin/post.php...

CVE-2020-35582: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp-admin/post.php request with the posttitle parameter...

PT-2021-11843

Name of the Vulnerable Software and Affected Versions: Simple Board Job plugin versions 2.9.3 and earlier Description: A directory traversal issue allows remote attackers to read arbitrary files via the sjb file parameter to "wp-admin/post.php". Recommendations: For Simple Board Job plugin versio...

PT-2021-11809

Name of the Vulnerable Software and Affected Versions: Envira Gallery Lite versions prior to 1.8.3.3 Description: A stored cross-site scripting XSS issue allows remote attackers to inject arbitrary JavaScript/HTML code via a POST "/wp-admin/post.php" request with the post title parameter...

CVE-2020-26672: Improper Neutralization of Input During Web Page Generation

Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting XSS in /wp-admin/post.php. If a user intercepts a request and inserts a payload in "cite" parameter, the payload will be stored in the database...

PT-2020-16483

Name of the Vulnerable Software and Affected Versions Testimonial Rotator Wordpress Plugin version 3.0.2 Description The issue concerns a Cross Site Scripting XSS problem. Specifically, it involves the /wp-admin/post.php endpoint. If a user intercepts a request and inserts a payload in the cite...

CVE-2020-14959: Improper Neutralization of Input During Web Page Generation

Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the wp-admin/post.php Client Name, Position, Web Address, Other, Location Reviewed, Product Reviewed, Item Reviewed, or Rating parameter...

Victor CMS 1.0 - (post) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Victor CMS 1.0 - 'post' SQL Injection Exploit Author: BKpatron Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip Version: v1.0 Tested on: Win 10 CV...

Victor CMS 1.0 SQL Injection

Exploit Title: Victor CMS 1.0 - 'post' SQL Injection Google Dork: N/A Date: 2020-05-09 Exploit Author: BKpatron Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip Version: v1.0 Tested on: Win 10 CVE: N/A my website:...

Victor CMS 1.0 - 'post' SQL Injection

Exploit Title: Victor CMS 1.0 - 'post' SQL Injection Google Dork: N/A Date: 2020-05-09 Exploit Author: BKpatron Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip Version: v1.0 Tested on: Win 10 CVE: N/A my website:...