Sql injection

Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php...

CVE-2018-16771

Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php...

Hoosk PHP Code Execution Vulnerability

Hoosk is a user-centered content management system CMS. The system has built-in Codelgniter for creating responsive websites. Hoosk 1.7.0 suffers from a PHP code execution vulnerability that can be exploited by an attacker to execute arbitrary code via the SiteUrl provided during installation...

CVE-2018-16771: Improper Control of Generation of Code

Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php...

CVE-2018-11583

SeaCMS 6.61 has stored XSS in admincollect.php via the siteurl parameter...

Cross site scripting

SeaCMS 6.61 has stored XSS in admincollect.php via the siteurl parameter...

CVE-2018-11583

SeaCMS 6.61 has stored XSS in admincollect.php via the siteurl parameter...

CVE-2018-11583

SeaCMS 6.61 has stored XSS in admincollect.php via the siteurl parameter...

CVE-2018-11583

CVE-2018-11583 affects SeaCMS 6.61, with a stored XSS in admin_collect.php via the siteurl parameter. Root cause per records is unescaped/sanitized input in siteurl leading to script injection. NVD metrics indicate confidentiality impact NONE and integrity impact PARTIAL (availability NONE); user...

SeaCMS Cross-Site Scripting Vulnerability

SeaCMS is a free and open source web content management system written in PHP. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in SeaCMS version 6.61. A remote attacker can exploit this vulnerability to inject arbitrary web...

CVE-2018-11583: Improper Neutralization of Input During Web Page Generation

SeaCMS 6.61 has stored XSS in admincollect.php via the siteurl parameter...

CVE-2018-8966

An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

Code injection

An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

CVE-2018-8966

An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

CVE-2018-8966

An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

CVE-2018-8966

The CVE-2018-8966 entry affects zzcms version 8.2, where the siteurl parameter of install/index.php can be exploited to inject PHP code. The issue is demonstrated by injecting a phpinfo() call into /inc/config.php, indicating code execution via a parameter. Several connected sources corroborate t...

PT-2018-18745 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: zzcms version 8.2 Description: An issue in zzcms allows PHP code injection via the siteurl parameter to the "install/index.php" endpoint, enabling the injection of PHP code, such as a phpinfo call, into "/inc/config.php". Recommendations: For...

CVE-2018-8966: Improper Control of Generation of Code

An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php, as demonstrated by injecting a phpinfo call into /inc/config.php...

WordPress 3.8.2 patch analysis HMAC timing attack-vulnerability warning-the black bar safety net

author: [email protected] 0x00 background On github over and over to see for a long time, the official version of the diff only in php where changes to a location: | 1 2 | - if $hmac != $hash + if hashhmac 'md5', $hmac, $key !== hashhmac 'md5', $hash, $key ---|--- WP developers just...

CVE-2012-5003: Improper Authentication

nxapplet.jar in No Machine NX Web Companion 3.x and earlier does not properly verify the authenticity of updates, which allows user-assisted remote attackers to execute arbitrary code via a crafted 1 SiteUrl or 2 RedirectUrl parameter that points to a Trojan Horse client.zip update file...