Show filters
267 Total Results
Displaying 221-230 of 267
Sort by:
Attacker Value
Unknown
CVE-2018-7700
Disclosure Date: March 27, 2018 (last updated November 26, 2024)
DedeCMS 5.7 has CSRF with an impact of arbitrary code execution, because the partcode parameter in a tag_test_action.php request can specify a runphp field in conjunction with PHP code.
0
Attacker Value
Unknown
CVE-2018-6910
Disclosure Date: February 13, 2018 (last updated November 26, 2024)
DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/inc_archives_functions.php.
0
Attacker Value
Unknown
CVE-2018-6881
Disclosure Date: February 12, 2018 (last updated November 26, 2024)
EmpireCMS 6.6 allows remote attackers to discover the full path via an array value for a parameter to admin/tool/ShowPic.php.
0
Attacker Value
Unknown
CVE-2017-17752
Disclosure Date: December 20, 2017 (last updated November 26, 2024)
Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message, with JavaScript code executed on the Read Mail screen (aka the /_readmail URI). This is fixed in version 4.2.4.
0
Attacker Value
Unknown
CVE-2017-17727
Disclosure Date: December 18, 2017 (last updated November 26, 2024)
DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/article_edit.php.
0
Attacker Value
Unknown
CVE-2017-17731
Disclosure Date: December 18, 2017 (last updated November 26, 2024)
DedeCMS through 5.7 has SQL Injection via the $_FILES superglobal to plus/recommend.php.
0
Attacker Value
Unknown
CVE-2017-17730
Disclosure Date: December 18, 2017 (last updated November 26, 2024)
DedeCMS through 5.7 has SQL Injection via the logo parameter to plus/flink_add.php.
0
Attacker Value
Unknown
CVE-2017-8875
Disclosure Date: May 10, 2017 (last updated November 26, 2024)
CSRF in the Clean Login plugin before 1.8 for WordPress allows remote attackers to change the login redirect URL or logout redirect URL.
0
Attacker Value
Unknown
CVE-2015-4383
Disclosure Date: June 15, 2015 (last updated October 05, 2023)
Cross-site request forgery (CSRF) vulnerability in the Decisions module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that remove individual voters via unspecified vectors.
0
Attacker Value
Unknown
CVE-2015-0260
Disclosure Date: February 16, 2015 (last updated October 05, 2023)
RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
0
