PT-2018-14712

Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description The issue allows for file deletion due to an authentication check occurring too late. This can be exploited via the "/mc-admin/post.php?state=delete&delete=" endpoint, where an attacker can delete files without...

CVE-2018-18427

s-cms 3.0 allows SQL Injection via the member/post.php 0id parameter or the POST data to member/memberlogin.php...

Sql injection

s-cms 3.0 allows SQL Injection via the member/post.php 0id parameter or the POST data to member/memberlogin.php...

CVE-2018-18427

s-cms 3.0 allows SQL Injection via the member/post.php 0id parameter or the POST data to member/memberlogin.php...

CVE-2018-18427

CVE-2018-18427 affects s-cms 3.0. The vulnerability is a SQL injection in the web app, exploitable via the parameter 0_id in member/post.php or via POST data to member/member_login.php. The issue is triggered by unsafely handled input, enabling an attacker to manipulate SQL queries. The CVE entry...

PT-2018-14454

Name of the Vulnerable Software and Affected Versions s-cms version 3.0 Description The issue allows for SQL Injection, which can be exploited via the "0 id" parameter in the "member/post.php" endpoint or through the POST data sent to the "member/member login.php" endpoint. Recommendations For...

CVE-2018-18427: Improper Neutralization of Special Elements used in an SQL Command

s-cms 3.0 allows SQL Injection via the member/post.php 0id parameter or the POST data to member/memberlogin.php...

PT-2018-14009

Name of the Vulnerable Software and Affected Versions Super Cms Blog Pro version 1.0 Description A SQL Injection issue exists in the authors post.php file of Super Cms Blog Pro, specifically via the author parameter. Recommendations For Super Cms Blog Pro version 1.0, consider restricting access ...

CVE-2018-16298: Improper Neutralization of Input During Web Page Generation

An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request...

PT-2018-13474

Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description An issue was discovered in MiniCMS. There is an XSS vulnerability in the 'mc-admin/post.php' endpoint for requests with a 'state' parameter set to 'delete', 'draft', or 'publish'. Recommendations For MiniCMS...

CVE-2018-15899

An issue was discovered in MiniCMS 1.10. There is a post.php?date= XSS vulnerability...

CVE-2018-15899

An issue was discovered in MiniCMS 1.10. There is a post.php?date= XSS vulnerability...

Spoofing

An issue was discovered in MiniCMS 1.10. There is a post.php?date= XSS vulnerability...

CVE-2018-15899

CVE-2018-15899 concerns a cross-site scripting (XSS) vulnerability in MiniCMS 1.10. The issue is triggered via the date parameter in the post.php file (post.php?date=), allowing remote attackers to inject arbitrary web script or HTML. Public descriptions across multiple sources (NVD, CNVD) confir...

CVE-2018-15899: Improper Neutralization of Input During Web Page Generation

An issue was discovered in MiniCMS 1.10. There is a post.php?date= XSS vulnerability...

UBUNTU-CVE-2018-12895

WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the...

CVE-2018-12895

WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the...

CVE-2018-12895: Improper Limitation of a Pathname to a Restricted Directory

WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the...

PT-2018-11457

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.9.7 Description The issue allows Author users to execute arbitrary code by leveraging directory traversal in the "wp-admin/post.php" endpoint, specifically the thumb parameter, which is passed to the PHP unlink...

CVE-2018-11632

The CVE-2018-11632 issue affects the WordPress plugin Add Social Share Messenger Buttons Whatsapp and Viber (version 1.0.8) by lack of nonce/capability checks in whatsapp_share_setting_add_update(), enabling CSRF to change settings when an admin visits a crafted URL via spear phishing/social engi...