26 matches found
CVE-2026-51564
CVE-2026-51564 Aviso de seguridad para CVE-2026-51564 Descripción Un problema en el parámetro redirect en Milk admin =0.9.8 permite a atacantes remotos redirigir a los usuarios a URLs externas arbitrarias mediante una solicitud manipulada. Componentes afectados: App/Route.php, publichtml/index.ph...
EUVD-2019-16271
Malware in sbrugna...
PT-2023-12442 · WordPress · Ulisting
Name of the Vulnerable Software and Affected Versions: uListing plugin for WordPress versions up to, and including, 1.6.6 Description: The issue is related to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file. This affects the...
Cross site request forgery (csrf)
Cross Site Request Forgery CSRF vulnerability exist in PopojiCMS 2.0.1 in po-admin/route.php?mod=user&act=multidelete...
CVE-2021-28070
CVE-2021-28070 describes a Cross-Site Request Forgery (CSRF) vulnerability in PopojiCMS 2.0.1, specifically in po-admin/route.php?mod=user&act=multidelete. The connected Red Hat, CNVD, CNVD-like and other listings confirm the same issue but do not provide concrete exploit details in these documen...
CVE-2021-28070: Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery CSRF vulnerability exist in PopojiCMS 2.0.1 in po-admin/route.php?mod=user&act=multidelete...
CVE-2019-18816
po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post1content= stored XSS...
CVE-2019-18816: Improper Neutralization of Input During Web Page Generation
po-admin/route.php?mod=post&act=edit in PopojiCMS 2.0.1 allows post1content= stored XSS...
CVE-2019-9549
An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=user&act=addnew URI, as demonstrated by adding a level=1 account, a similar issue to CVE-2018-18935...
CVE-2019-9549: Cross-Site Request Forgery (CSRF)
An issue was discovered in PopojiCMS v2.0.1. It has CSRF via the po-admin/route.php?mod=user&act=addnew URI, as demonstrated by adding a level=1 account, a similar issue to CVE-2018-18935...
CVE-2019-7580
ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admincategory/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection...
CVE-2019-7580
ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admincategory/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection...
CVE-2019-7580: Improper Control of Generation of Code
ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code via the portal/admincategory/addpost.html alias parameter because the mishandling of a single quote character allows data/conf/route.php injection...
CVE-2019-6713
app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving portal/List/index and list/:id to inject this code into data\conf\route.php, as demonstrated by a fileputcontents call...
CVE-2019-6713: Improper Control of Generation of Code
app\admin\controller\RouteController.php in ThinkCMF 5.0.190111 allows remote attackers to execute arbitrary PHP code by using vectors involving portal/List/index and list/:id to inject this code into data\conf\route.php, as demonstrated by a fileputcontents call...
Code injection
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the route.php paymentMethod parameter...
CVE-2018-19186
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the route.php paymentMethod parameter...
CVE-2018-19186
CVE-2018-19186 concerns the Amazon PAYFORT payfort-php-SDK (payment gateway SDK) through 2018-04-26, where a cross-site scripting (XSS) flaw exists in the route.php paymentMethod parameter. The vulnerability is evidenced in NVD and corroborated by multiple sources (CNVD/CVE records). Affected com...
CVE-2018-19186
The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the route.php paymentMethod parameter...
PT-2018-14847
Name of the Vulnerable Software and Affected Versions payfort-php-SDK versions through 2018-04-26 Description The issue concerns an XSS vulnerability via the paymentMethod parameter in the route.php file. Recommendations For payfort-php-SDK versions through 2018-04-26, consider restricting access...