362 matches found
CVE-2018-16237: Improper Limitation of a Pathname to a Restricted Directory
An issue was discovered in damiCMS V6.0.1. There is Directory Traversal via '|' characters in the s parameter to admin.php, as demonstrated by an admin.php?s=Tpl/Add/id/c:|windows|win.ini URI...
CVE-2018-7764: Improper Limitation of a Pathname to a Restricted Directory
The vulnerability exists within runscript.php applet in Schneider Electric U.motion Builder software versions prior to v1.3.4. There is a directory traversal vulnerability in the processing of the 's' parameter of the applet...
LFCMS Cross-Site Request Forgery Vulnerability
LFCMS is a PHP based on THINKPHP3.2.3 framework development, suitable for all kinds of video, film and television websites, film and television content management program. LFCMS 3.7.0 admin.php cross-site request forgery vulnerability exists. Remote attackers can use this vulnerability to hijack...
CVE-2018-12603
Cross-site request forgery CSRF vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecified users for requests that add administrator users via the s parameter, a related issue to CVE-2018-12114...
CVE-2018-12603: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecified users for requests that add administrator users via the s parameter, a related issue to CVE-2018-12114...
CVE-2018-11568
Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter. In some but not all cases, the '' characters have and representations...
CVE-2018-11568: Improper Neutralization of Input During Web Page Generation
Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter. In some but not all cases, the '' characters have representations...
CVE-2018-10374: Improper Neutralization of Input During Web Page Generation
EasyCMS 1.3 has XSS via the s POST parameter aka a search box value in an index.php?s=/index/search/index.html request...
CVE-2018-10225
thinkphp 3.1.3 has SQL Injection via the index.php s parameter...
CVE-2018-10225: Improper Neutralization of Special Elements used in an SQL Command
thinkphp 3.1.3 has SQL Injection via the index.php s parameter...
Schneider Electric U.motion Builder Directory Traversal Vulnerability
U.motion Builder is a generator product from Schneider Electric France. A directory traversal vulnerability exists in Schneider Electric U.motion Builder when handling the 's' parameter of an applet. The vulnerability exists in the runscript.php applet and can be exploited to obtain sensitive...
CVE-2011-4955: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in uistats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 s or 2 p parameters to index.php...
Techno - Portfolio Management Panel SQL Injection Vulnerability
Techno - Portfolio Management Panel is a set of portfolio management panel scripts. A SQL injection vulnerability exists in Techno - Portfolio Management Panel 2017-11-16 and earlier versions. A remote attacker can exploit the vulnerability by sending the 's' parameter to the panel/search.php fil...
CVE-2017-17696
Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php...
CVE-2017-17696
Techno - Portfolio Management Panel is affected by an information disclosure vulnerability through an invalid s parameter to panel/search.php, enabling disclosure of sensitive paths. The CVE notes impact as a path disclosure; affected versions include 2017-11-16 and earlier. Connected sources (CN...
CVE-2017-17696: Exposure of Sensitive Information to an Unauthorized Actor
Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php...
CVE-2017-17695: Improper Neutralization of Special Elements used in an SQL Command
Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter...
CVE-2017-17694: Improper Neutralization of Input During Web Page Generation
Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter...
Creative Management System Lite SQL Injection Vulnerability
Creative Management System CMS Lite is a web content management system with features such as menu design, site backup and site calendar. A SQL injection vulnerability exists in CMS Lite version 1.4. A remote attacker can exploit the vulnerability by sending the 'S' parameter to the index.php file...
