CVE-2018-8078: Improper Neutralization of Input During Web Page Generation

YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html...

Design/Logic Flaw

QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI...

CVE-2018-8070

QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI...

CVE-2018-8070

QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI...

CVE-2018-8070

CVE-2018-8070 describes an XSS vulnerability in QCMS 3.0 triggered by the title parameter to the /guest/index.html URI. The issue is due to improper handling of user-supplied input in that parameter, enabling cross-site scripting. Multiple connected sources (Red Hat, CNVD, and others) confirm the...

PT-2018-18416

Name of the Vulnerable Software and Affected Versions: QCMS version 3.0 Description: The issue is related to an XSS vulnerability. It can be exploited via the title parameter to the "/guest/index.html" URI. Recommendations: For QCMS version 3.0, update to a version that includes a fix for this...

QCMS cross-site scripting vulnerability (CNVD-2018-06392)

QCMS is an open source content management system CMS for creating responsive websites. A cross-site scripting vulnerability exists in QCMS version 3.0. A remote attacker can exploit this vulnerability by sending the 'title' parameter to the /guest/index.html URI to obtain a user cookie...

CVE-2018-8070: Improper Neutralization of Input During Web Page Generation

QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI...

lyadmin cross-site scripting vulnerability

lyadmin is a set of lightweight general background, using ThinkPHP + Bootstrap3 production, built-in system settings, upload management, rights management, module management, plug-in management and other functions. lyadmin 1.x is vulnerable to cross-site scripting. Attackers can use the...

CVE-2018-7547

lyadmin 1.x has XSS via the configWEBSITETITLE parameter to the /admin.php?s=/admin/config/groupsave.html URI...

PT-2018-18150

Name of the Vulnerable Software and Affected Versions lyadmin versions 1.x Description The issue allows for XSS via the configWEB SITE TITLE parameter to the "/admin.php?s=/admin/config/groupsave.html" API endpoint. Recommendations For lyadmin version 1.x, update to a version that fixes this issu...

CMS Made Simple 2.1.6 Remote Code Execution Vulnerability

Exploit for php platform in category web applications Exploit Title: CMS Made Simple 2.1.6 - Remote Code Execution Date: 2018-02-26 Exploit Author: Keerati T. Vendor Homepage: http://www.cmsmadesimple.org/ Software Link: http://s3.amazonaws.com/cmsms/downloads/13570/cmsms-2.1.6-install.zip Versio...

CVE-2018-7447: Improper Neutralization of Input During Web Page Generation

mojoPortal through 2.6.0.0 is prone to multiple persistent cross-site scripting vulnerabilities because it fails to sanitize user-supplied input. The 'Title' and 'Subtitle' fields of the 'Blog' page are vulnerable. NOTE: The software maintainer disputes this as a vulnerability because the fields...

PT-2018-18076 · Mojoportal · Mojoportal

Name of the Vulnerable Software and Affected Versions: mojoPortal versions prior to 2.6.0.0 Description: The issue arises from the software's failure to sanitize user-supplied input, leading to multiple persistent cross-site scripting vulnerabilities. Specifically, the Title and Subtitle fields o...

MojoPortal Cross-Site Scripting Vulnerability (CNVD-2018-05173)

mojoPortal is an American programmer Joe Audette developed a set of open source , object-oriented Web site architecture WSF and content management system CMS, it provides event calendar , photo albums , file manager and so on. A cross-site scripting vulnerability exists in the Title and Subtitle...

CVE-2018-7318

SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the titlesearch, tagsearch, namesearch, descriptionsearch, or filterorder parameter...

PT-2018-3604

Name of the Vulnerable Software and Affected Versions Joomla! CheckList component version 1.1.1 Description The issue is related to SQL Injection in the CheckList component of Joomla!. This occurs due to inadequate protection against SQL query structure exploitation. An attacker can exploit this ...

CVE-2018-7261

There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4. They affect Personal Preferences Name and Username and Configuration Site Title, Dev Site Domain, Page Parts, and Page Fields...

CVE-2018-7274: Improper Neutralization of Input During Web Page Generation

Yab Quarx through 2.4.3 is prone to multiple persistent cross-site scripting vulnerabilities: Blog Title, FAQ Question, Pages Title, Widgets Name, and Menus Name...

Radiant CMS 1.1.4 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications 1. Introduction Vendor : Radiant Affected Product : Radiant CMS 1.1.4 Fixed in : NA Vendor Website : http://radiantcms.org/ Vulnerability Type : Persistent XSS Remote Exploitable : Yes CVE External Identifier : CVE-2018-7261 2. Overview...