CVE-2025-9151 LiuYuYang01 ThriveX-Blog web updateJsonValueByName improper authorization

A security flaw has been discovered in LiuYuYang01 ThriveX-Blog up to 3.1.7. Affected by this vulnerability is the function updateJsonValueByName of the file /webconfig/json/name/web. Performing manipulation results in improper authorization. It is possible to initiate the attack remotely. The...

CVE-2018-19170

In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the webname parameter...

CVE-2018-19170

In JPress v1.0-rc.5, there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI, as demonstrated by the webname parameter...

PT-2018-14839

Name of the Vulnerable Software and Affected Versions JPress version 1.0-rc.5 Description The issue concerns stored XSS that can be triggered via the first three input fields. This is demonstrated by the web name parameter in the "/starter-tomcat-1.0/admin/setting" API endpoint. Recommendations F...

CVE-2018-17126

CScms 4.1 allows remote code execution, as demonstrated by 1';eval$POSTcmd; in Web Name to upload\plugins\sys\Install.php...

PT-2018-13907

Name of the Vulnerable Software and Affected Versions CScms version 4.1 Description The issue allows remote code execution. This can be demonstrated by using the input 1';eval$ POSTcmd; in the Web Name field to upload a file to pluginssysInstall.php. Recommendations For CScms version 4.1, as a...