Sql injection

BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...

CVE-2018-16432: Improper Neutralization of Special Elements used in an SQL Command

BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...

CVE-2018-16432

BlueCMS 1.6 allows SQL Injection via the username parameter to uploads/user.php?act=indexlogin...

Remote Code Execution Vulnerability in All Series of ECShop Versions

ECShop is a B2C independent online store system, suitable for enterprises and individuals to quickly build a personalized online store. The system is based on PHP language and MYSQL database structure development of cross-platform open source program. A remote code execution vulnerability exists ...

CVE-2018-14971

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS...

CVE-2018-14971: Improper Neutralization of Input During Web Page Generation

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS...

CVE-2018-8925

Cross-site request forgery CSRF vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijack the authentication of administrators via the 1 username, 2 password, 3 admin, 4 action, 5 uid, or 6 modifyadmin parameter...

CVE-2018-8925

Cross-site request forgery CSRF vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijack the authentication of administrators via the 1 username, 2 password, 3 admin, 4 action, 5 uid, or 6 modifyadmin parameter...

CVE-2018-8925: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin/user.php in Synology Photo Station before 6.8.5-3471 and before 6.3-2975 allows remote attackers to hijack the authentication of administrators via the 1 username, 2 password, 3 admin, 4 action, 5 uid, or 6 modifyadmin parameter...

CVE-2018-10268

An issue was discovered in FastAdmin V1.0.0.20180417beta. There is XSS via the application\api\controller\User.php avatar parameter...

CVE-2018-10268

An issue was discovered in FastAdmin V1.0.0.20180417beta. There is XSS via the application\api\controller\User.php avatar parameter...

CVE-2018-10268

An issue was discovered in FastAdmin V1.0.0.20180417beta. There is XSS via the application\api\controller\User.php avatar parameter...

CVE-2018-10268: Improper Neutralization of Input During Web Page Generation

An issue was discovered in FastAdmin V1.0.0.20180417beta. There is XSS via the application\api\controller\User.php avatar parameter...

CVE-2018-9162

Contec Smart Home 4.15 devices do not require authentication for newuser.php, edituser.php, deleteuser.php, and user.php, as demonstrated by changing the admin password and then obtaining control over doors...

CVE-2018-9162: Missing Authentication for Critical Function

Contec Smart Home 4.15 devices do not require authentication for newuser.php, edituser.php, deleteuser.php, and user.php, as demonstrated by changing the admin password and then obtaining control over doors...

clickthecity.com XSS vulnerability

Open Bug Bounty ID: OBB-572674 Description| Value ---|--- Affected Website:| clickthecity.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-6009

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity...

CVE-2018-6009

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity...

CVE-2018-6009

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity...

CVE-2018-6009: Cross-Site Request Forgery (CSRF)

In Yii Framework 2.x before 2.0.14, the switchIdentity function in web/User.php did not regenerate the CSRF token upon a change of identity...