CVE-2018-12622

An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the fieldname parameter...

CVE-2018-12622

An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the fieldname parameter...

CVE-2018-12622

An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the fieldname parameter...

CVE-2018-12622: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the fieldname parameter...

QYKCMS update.php page has an arbitrary file deletion vulnerability

QYKCMS is a lightweight intelligent website building system based on PHP+MySql developed by QYK. QYKCMS update.php page exists arbitrary file deletion vulnerability. Allow attackers to exploit the vulnerability to delete arbitrary files, such as deleting install.lck for CMS reloading, hijacking t...

CVE-2015-7670: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in includes/update.php in the Support Ticket System plugin before 1.2.1 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 user or 2 id parameter...

CVE-2017-9444: Cross-Site Request Forgery (CSRF)

BigTree CMS through 4.2.18 has CSRF related to the core\admin\modules\users\profile\update.php script modify user information, the index.php/admin/developer/packages/delete/ URI remove packages, the index.php/admin/developer/upgrade/ignore/?versions= URI, and the...

Steam Profile Integration 2.0.11 - SQL injection

Steam Profile Integration 2.0.11 - SQL injection Exploit Title: IPS Community Suite - Steam Profile Integration 2.0.11 and below SQL injection Google Dork: inurl:tab=nodesteamsteamprofile Date: 13/03/2017 Exploit Author: DrWhat Vendor Homepage:...

akasa.cn XSS vulnerability

Vulnerable URL: http://akasa.cn/update.php?no=181=AK-HPC01-BK="=product/product.detail.tplsub=2.5 Enclosure Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 14:48 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

akasa.biz XSS vulnerability

Vulnerable URL: http://www.akasa.biz/update.php?no=181="=Notebook coolers=product/product.detail.tplsub=NB Coolers Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

PT-2015-7542

Name of the Vulnerable Software and Affected Versions refbase versions through 0.9.6 refbase bleeding-edge versions through 2015-04-28 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the adminUserName, pathToMYSQL,...

CVE-2015-7383: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Web Reference Database aka refbase through 0.9.6 and bleeding-edge through 2015-04-28 allow remote attackers to inject arbitrary web script or HTML via the 1 adminUserName, 2 pathToMYSQL, 3 databaseStructureFile, or 4 pathToBibutils parameter t...

osCommerce <= 2.2 (extras) Source Code Disclosure Vulnerability

No description provided by source. ---- osCommerce = 2.2 extras/ information/source code disclosure ------------ software site: http://www.oscommerce.com/ if extras/ folder is placed inside the www path, you can see all files on target system, including php source code with database details, poc:...

Logaholic update.php page Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/27003/info Logaholic is prone to multiple input-validation vulnerabilities, including multiple SQL-injection issues, a cross-site scripting issue, and an HTML-injection issue. The issues occur because the application fail...

CVE-2013-5313: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in core/admin/modules/users/update.php in BigTree CMS 4.0 RC2 and earlier allows remote attackers to hijack the authentication of administrators for requests that modify arbitrary user accounts via an edit user action...

Secworld waf /admin/ids/waf_update.php 命令执行漏洞

No description provided by source...

CVE-2012-5231

miniCMS 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code via a crafted 1 pagename or 2 area variable containing an executable extension, which is not properly handled by a update.php when writing files to content/, or b updatenews.php when writing files to content/news/...

Code injection

miniCMS 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code via a crafted 1 pagename or 2 area variable containing an executable extension, which is not properly handled by a update.php when writing files to content/, or b updatenews.php when writing files to content/news/...

CVE-2012-5231: Improper Control of Generation of Code

miniCMS 1.0 and 2.0 allows remote attackers to execute arbitrary PHP code via a crafted 1 pagename or 2 area variable containing an executable extension, which is not properly handled by a update.php when writing files to content/, or b updatenews.php when writing files to content/news/...

CVE-2012-4393

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use 1 addBookmark.php, 2 delBookmark.php, or 3 editBookmark.php in bookmarks/ajax/; 4 calendar/delete.php, 5 calendar/edit.php...