16 matches found
Cross site scripting
An XSS issue was discovered in app/search/search.app.php in idreamsoft iCMS 7.0.14 via the public/api.php?app=search q parameter...
CVE-2019-11427
The CVE-2019-11427 entry concerns an XSS vulnerability in idreamsoft iCMS 7.0.14, exploitable via the public/api.php?app=search&q parameter within the file app/search/search.app.php. Connected sources consistently describe the issue as a Cross-Site Scripting vulnerability in iCMS 7.0.14, with no ...
CVE-2019-11427
An XSS issue was discovered in app/search/search.app.php in idreamsoft iCMS 7.0.14 via the public/api.php?app=search q parameter...
PT-2019-12306
Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.14 Description A cross-site scripting XSS issue was found in the app/search/search.app.php file of idreamsoft iCMS. The issue is related to the q parameter in the "public/api.php?app=search" API endpoint...
CVE-2019-11427: Improper Neutralization of Input During Web Page Generation
An XSS issue was discovered in app/search/search.app.php in idreamsoft iCMS 7.0.14 via the public/api.php?app=search q parameter...
CVE-2019-8902
An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI...
CVE-2019-8902
An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI...
CVE-2019-8902: Cross-Site Request Forgery (CSRF)
An issue was discovered in idreamsoft iCMS through 7.0.14. A CSRF vulnerability can delete users' articles via the public/api.php?app=user URI...
PT-2019-19250
Name of the Vulnerable Software and Affected Versions idreamsoft iCMS versions prior to 7.0.15 Description A CSRF issue allows deletion of users' articles via the "public/api.php?app=user" API endpoint. Recommendations For versions prior to 7.0.15, update to version 7.0.15 or later to resolve the...
CVE-2018-17049
CQU-LANKERS through 2017-11-02 has XSS via the public/api.php callback parameter in an uploadpic action...
CVE-2018-17049: Improper Neutralization of Input During Web Page Generation
CQU-LANKERS through 2017-11-02 has XSS via the public/api.php callback parameter in an uploadpic action...
PT-2018-13861
Name of the Vulnerable Software and Affected Versions CQU-LANKERS through 2017-11-02 Description The issue is related to a security problem where an attacker can execute malicious scripts. This is achieved by exploiting the callback parameter in the "public/api.php" endpoint, specifically in an...
Design/Logic Flaw
An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request, bypassing the iWAF protection mechanism...
CVE-2018-13865
An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request, bypassing the iWAF protection mechanism...
PT-2018-12232
Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.9 Description An issue exists where XSS is possible via the callback parameter in a "public/api.php" uploadpic request, which bypasses the iWAF protection mechanism. Recommendations For idreamsoft iCMS version 7.0.9...
CVE-2018-13865: Improper Neutralization of Input During Web Page Generation
An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request, bypassing the iWAF protection mechanism...