d4wner/Vulnerabilities-Report

Releases0

Stars11

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2018-5673 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	6.8 MEDIUM
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. CSRF exists via wp-admin/admin.php.
CVE-2018-5672 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	3.5 LOW
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_field5[label] parameter.
CVE-2018-5671 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	3.5 LOW
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php extra_field1[items][field_item1][price_percent] parameter.
CVE-2018-5670 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	3.5 LOW
An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditions[count][] parameter.
CVE-2018-5669 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	6.8 MEDIUM
An issue was discovered in the read-and-understood plugin 2.1 for WordPress. CSRF exists via wp-admin/options-general.php.
CVE-2018-5668 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	3.5 LOW
An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_validation_title parameter.
CVE-2018-5667 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	3.5 LOW
An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_validation_pattern parameter.
CVE-2018-5666 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	3.5 LOW
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php bg_color parameter.
CVE-2018-5665 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	3.5 LOW
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_height parameter.
CVE-2018-5664 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	3.5 LOW
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php social_icon_1 parameter.
CVE-2018-5663 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	3.5 LOW
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php button_text_link parameter.
CVE-2018-5662 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	3.5 LOW
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title parameter.
CVE-2018-5661 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	3.5 LOW
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_width parameter.
CVE-2018-5660 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	3.5 LOW
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_sub_title parameter.
CVE-2018-5659 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	3.5 LOW
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_title parameter.
CVE-2018-5658 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	6.8 MEDIUM
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. CSRF exists via wp-admin/admin.php.
CVE-2018-5657 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	3.5 LOW
An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title_icon parameter.
CVE-2018-5656 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	6.8 MEDIUM
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. CSRF exists via wp-admin/admin-ajax.php.
CVE-2018-5655 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	4.3 MEDIUM
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php security parameter.
CVE-2018-5654 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	4.3 MEDIUM
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php PFFREE_Access_Token parameter.
CVE-2018-5653 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	4.3 MEDIUM
An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php weblizar_pffree_settings_save_get-users parameter.
CVE-2018-5652 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	3.5 LOW
An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_end parameter.
CVE-2018-5651 ↗	Jan 13, 2018Saturday, 13 January 2018, 00:29	—	3.5 LOW
An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_start parameter.
CVE-2018-5369 ↗	Jan 12, 2018Friday, 12 January 2018, 09:29	—	3.5 LOW
The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificator parameter.
CVE-2018-5368 ↗	Jan 12, 2018Friday, 12 January 2018, 09:29	—	6.8 MEDIUM
The SrbTransLatin plugin 1.46 for WordPress has CSRF via an srbtranslatoptions action to wp-admin/options-general.php.
CVE-2018-5367 ↗	Jan 12, 2018Friday, 12 January 2018, 09:29	—	3.5 LOW
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][post] parameter to wp-admin/options.php.
CVE-2018-5366 ↗	Jan 12, 2018Friday, 12 January 2018, 09:29	—	3.5 LOW
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[more_languages] parameter to wp-admin/options.php.
CVE-2018-5365 ↗	Jan 12, 2018Friday, 12 January 2018, 09:29	—	3.5 LOW
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[selector_wp_list_pages][show_selector] parameter to wp-admin/options.php.
CVE-2018-5364 ↗	Jan 12, 2018Friday, 12 January 2018, 09:29	—	3.5 LOW
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[browser_redirect][redirect_by_language] parameter to wp-admin/options.php.
CVE-2018-5363 ↗	Jan 12, 2018Friday, 12 January 2018, 09:29	—	3.5 LOW
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[enabled_languages][en] or wpglobus_option[enabled_languages][fr] (or any other language) parameter to wp-admin/options.php.
CVE-2018-5362 ↗	Jan 12, 2018Friday, 12 January 2018, 09:29	—	3.5 LOW
The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[post_type][page] parameter to wp-admin/options.php.
CVE-2018-5361 ↗	Jan 12, 2018Friday, 12 January 2018, 09:29	—	6.8 MEDIUM
The WPGlobus plugin 1.9.6 for WordPress has CSRF via wp-admin/options.php.
CVE-2018-5312 ↗	Jan 9, 2018Tuesday, 9 January 2018, 05:29	—	3.5 LOW
The tabs-responsive plugin 1.8.0 for WordPress has XSS via the post_title parameter to wp-admin/post.php.
CVE-2018-5311 ↗	Jan 9, 2018Tuesday, 9 January 2018, 05:29	—	3.5 LOW
The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjoo_ecae_options[custom_css] parameter to the wp-admin/admin.php?page=tonjoo_excerpt URI.
CVE-2018-5310 ↗	Jan 9, 2018Tuesday, 9 January 2018, 05:29	—	4 MEDIUM
In the "Media from FTP" plugin before 9.85 for WordPress, Directory Traversal exists via the searchdir parameter to the wp-admin/admin.php?page=mediafromftp-search-register URI.
CVE-2018-5293 ↗	Jan 8, 2018Monday, 8 January 2018, 07:29	—	4.3 MEDIUM
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.
CVE-2018-5292 ↗	Jan 8, 2018Monday, 8 January 2018, 07:29	—	4.3 MEDIUM
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-information page.
CVE-2018-5291 ↗	Jan 8, 2018Monday, 8 January 2018, 07:29	—	5 MEDIUM
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-tools page.
CVE-2018-5290 ↗	Jan 8, 2018Monday, 8 January 2018, 07:29	—	5 MEDIUM
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.
CVE-2018-5289 ↗	Jan 8, 2018Monday, 8 January 2018, 07:29	—	5 MEDIUM
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-information page.
CVE-2018-5288 ↗	Jan 8, 2018Monday, 8 January 2018, 07:29	—	4.3 MEDIUM
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-transfer page.
CVE-2018-5287 ↗	Jan 8, 2018Monday, 8 January 2018, 07:29	—	5 MEDIUM
The GD Rating System plugin 2.3 for WordPress has Directory Traversal in the wp-admin/admin.php panel parameter for the gd-rating-system-about page.
CVE-2018-5286 ↗	Jan 8, 2018Monday, 8 January 2018, 07:29	—	4.3 MEDIUM
The GD Rating System plugin 2.3 for WordPress has XSS via the wp-admin/admin.php panel parameter for the gd-rating-system-about page.
CVE-2018-5285 ↗	Jan 8, 2018Monday, 8 January 2018, 07:29	—	6.8 MEDIUM
The ImageInject plugin 1.15 for WordPress has CSRF via wp-admin/options-general.php.
CVE-2018-5284 ↗	Jan 8, 2018Monday, 8 January 2018, 07:29	—	3.5 LOW
The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.
CVE-2018-5214 ↗	Jan 4, 2018Thursday, 4 January 2018, 18:29	—	3.5 LOW
The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via the al2fb_facebook_id parameter to wp-admin/profile.php.
CVE-2018-5213 ↗	Jan 4, 2018Thursday, 4 January 2018, 18:29	—	3.5 LOW
The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.php.
CVE-2018-5212 ↗	Jan 4, 2018Thursday, 4 January 2018, 18:29	—	3.5 LOW
The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/post.php.
CVE-2018-5072 ↗	Jan 3, 2018Wednesday, 3 January 2018, 20:29	—	3.5 LOW
Online Ticket Booking has XSS via the admin/sitesettings.php keyword parameter.
CVE-2018-5078 ↗	Jan 3, 2018Wednesday, 3 January 2018, 20:29	—	3.5 LOW
Online Ticket Booking has XSS via the admin/eventlist.php cast parameter.
CVE-2018-5077 ↗	Jan 3, 2018Wednesday, 3 January 2018, 20:29	—	3.5 LOW
Online Ticket Booking has XSS via the admin/movieedit.php moviename parameter.
CVE-2018-5076 ↗	Jan 3, 2018Wednesday, 3 January 2018, 20:29	—	3.5 LOW
Online Ticket Booking has XSS via the admin/newsedit.php newstitle parameter.
CVE-2018-5075 ↗	Jan 3, 2018Wednesday, 3 January 2018, 20:29	—	3.5 LOW
Online Ticket Booking has XSS via the admin/snacks_edit.php snacks_name parameter.
CVE-2018-5074 ↗	Jan 3, 2018Wednesday, 3 January 2018, 20:29	—	3.5 LOW
Online Ticket Booking has XSS via the admin/manageownerlist.php contact parameter.
CVE-2018-5073 ↗	Jan 3, 2018Wednesday, 3 January 2018, 20:29	—	6 MEDIUM
Online Ticket Booking has CSRF via admin/movieedit.php.
CVE-2017-17987 ↗	Dec 30, 2017Saturday, 30 December 2017, 04:29	—	6.5 MEDIUM
PHP Scripts Mall Muslim Matrimonial Script allows arbitrary file upload via admin/mydetails_edit.php.
CVE-2017-17995 ↗	Dec 30, 2017Saturday, 30 December 2017, 04:29	—	3.5 LOW
Biometric Shift Employee Management System has XSS via the Last_Name parameter in an index.php?user=ajax request.
CVE-2017-17982 ↗	Dec 30, 2017Saturday, 30 December 2017, 04:29	—	6 MEDIUM
PHP Scripts Mall Muslim Matrimonial Script has CSRF via admin/subadmin_edit.php.
CVE-2017-17983 ↗	Dec 30, 2017Saturday, 30 December 2017, 04:29	—	6.5 MEDIUM
PHP Scripts Mall Muslim Matrimonial Script has SQL injection via the view-profile.php mem_id parameter.
CVE-2017-17984 ↗	Dec 30, 2017Saturday, 30 December 2017, 04:29	—	3.5 LOW
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_edit.php edit_id parameter.
CVE-2017-17985 ↗	Dec 30, 2017Saturday, 30 December 2017, 04:29	—	3.5 LOW
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/state_view.php cou_id parameter.
CVE-2017-17986 ↗	Dec 30, 2017Saturday, 30 December 2017, 04:29	—	3.5 LOW
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/caste_view.php comm_id parameter.
CVE-2017-17981 ↗	Dec 30, 2017Saturday, 30 December 2017, 04:29	—	3.5 LOW
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/slider_edit.php edit_id parameter.
CVE-2017-17988 ↗	Dec 30, 2017Saturday, 30 December 2017, 04:29	—	3.5 LOW
PHP Scripts Mall Muslim Matrimonial Script has XSS via the admin/event_add.php event_title parameter.
CVE-2017-17989 ↗	Dec 30, 2017Saturday, 30 December 2017, 04:29	—	3.5 LOW
Biometric Shift Employee Management System has XSS via the index.php holiday_name parameter in an edit_holiday action.
CVE-2017-17990 ↗	Dec 30, 2017Saturday, 30 December 2017, 04:29	—	6.8 MEDIUM
Biometric Shift Employee Management System has CSRF via index.php in an edit_holiday action.
CVE-2017-17991 ↗	Dec 30, 2017Saturday, 30 December 2017, 04:29	—	3.5 LOW
Biometric Shift Employee Management System has XSS via the expense_name parameter in an index.php?user=expenses request.
CVE-2017-17992 ↗	Dec 30, 2017Saturday, 30 December 2017, 04:29	—	5 MEDIUM
Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php form_file_name parameter in a download_form action.
CVE-2017-17993 ↗	Dec 30, 2017Saturday, 30 December 2017, 04:29	—	3.5 LOW
Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=addition_deduction request.
CVE-2017-17994 ↗	Dec 30, 2017Saturday, 30 December 2017, 04:29	—	3.5 LOW
Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competency_criteria request.
CVE-2017-17959 ↗	Dec 28, 2017Thursday, 28 December 2017, 18:29	—	7.5 HIGH
PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the seller-view.php usid parameter.
CVE-2017-17952 ↗	Dec 28, 2017Thursday, 28 December 2017, 18:29	—	5 MEDIUM
PHP Scripts Mall PHP Multivendor Ecommerce has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofed e-mail address.
CVE-2017-17948 ↗	Dec 28, 2017Thursday, 28 December 2017, 18:29	—	4.3 MEDIUM
Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request.
CVE-2017-17958 ↗	Dec 28, 2017Thursday, 28 December 2017, 18:29	—	4.3 MEDIUM
PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the my_wishlist.php fid parameter.
CVE-2017-17957 ↗	Dec 28, 2017Thursday, 28 December 2017, 18:29	—	7.5 HIGH
PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the my_wishlist.php fid parameter.
CVE-2017-17956 ↗	Dec 28, 2017Thursday, 28 December 2017, 18:29	—	4.3 MEDIUM
PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the admin/sellerupd.php companyname parameter.
CVE-2017-17955 ↗	Dec 28, 2017Thursday, 28 December 2017, 18:29	—	4.3 MEDIUM
PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the shopping-cart.php cusid parameter.
CVE-2017-17954 ↗	Dec 28, 2017Thursday, 28 December 2017, 18:29	—	4.3 MEDIUM
PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the seller-view.php usid parameter.
CVE-2017-17953 ↗	Dec 28, 2017Thursday, 28 December 2017, 18:29	—	4.3 MEDIUM
PHP Scripts Mall PHP Multivendor Ecommerce has XSS via the category.php chid1 parameter.
CVE-2017-17960 ↗	Dec 28, 2017Thursday, 28 December 2017, 18:29	—	6.8 MEDIUM
PHP Scripts Mall PHP Multivendor Ecommerce has CSRF via admin/sellerupd.php.
CVE-2017-17951 ↗	Dec 28, 2017Thursday, 28 December 2017, 18:29	—	7.5 HIGH
PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the shopping-cart.php cusid parameter.
CVE-2017-17950 ↗	Dec 28, 2017Thursday, 28 December 2017, 18:29	—	6.5 MEDIUM
Cells Blog 3.5 has SQL Injection via the pub_readpost.php ptid parameter.
CVE-2017-17949 ↗	Dec 28, 2017Thursday, 28 December 2017, 18:29	—	4.3 MEDIUM
Cells Blog 3.5 has XSS via the pub_readpost.php fmid parameter.
CVE-2017-17936 ↗	Dec 28, 2017Thursday, 28 December 2017, 06:29	—	6.8 MEDIUM
Vanguard Marketplace Digital Products PHP has CSRF via /search.
CVE-2017-17941 ↗	Dec 28, 2017Thursday, 28 December 2017, 06:29	—	6.5 MEDIUM
PHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid parameter.
CVE-2017-17940 ↗	Dec 28, 2017Thursday, 28 December 2017, 06:29	—	3.5 LOW
PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php.
CVE-2017-17939 ↗	Dec 28, 2017Thursday, 28 December 2017, 06:29	—	6.8 MEDIUM
PHP Scripts Mall Single Theater Booking has CSRF via admin/sitesettings.php.
CVE-2017-17938 ↗	Dec 28, 2017Thursday, 28 December 2017, 06:29	—	3.5 LOW
PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter.
CVE-2017-17937 ↗	Dec 28, 2017Thursday, 28 December 2017, 06:29	—	4.3 MEDIUM
Vanguard Marketplace Digital Products PHP has XSS via the phps_query parameter to /search.
CVE-2017-17931 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	7.5 HIGH
PHP Scripts Mall Resume Clone Script has SQL Injection via the forget.php username parameter.
CVE-2017-17903 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	6.8 MEDIUM
FS Lynda Clone has CSRF via user/edit_profile, as demonstrated by adding content to the user panel.
CVE-2017-17930 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	6.8 MEDIUM
PHP Scripts Mall Professional Service Script has CSRF via admin/general_settingupd.php, as demonstrated by modifying a setting in the user panel.
CVE-2017-17929 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	3.5 LOW
PHP Scripts Mall Professional Service Script has XSS via the admin/bannerview.php view parameter.
CVE-2017-17928 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	7.5 HIGH
PHP Scripts Mall Professional Service Script has SQL injection via the admin/review.php id parameter.
CVE-2017-17927 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	5 MEDIUM
PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via a crafted PATH_INFO to service-list/category/.
CVE-2017-17926 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	5 MEDIUM
PHP Scripts Mall Professional Service Script has a predicable registration URL, which makes it easier for remote attackers to register with an invalid or spoofed e-mail address.
CVE-2017-17925 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	3.5 LOW
PHP Scripts Mall Professional Service Script has XSS via the admin/general_settingupd.php website_title parameter.
CVE-2017-17924 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	5 MEDIUM
PHP Scripts Mall Professional Service Script allows remote attackers to obtain sensitive full-path information via the id parameter to admin/review_userwise.php.
CVE-2017-17909 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	3.5 LOW
PHP Scripts Mall Responsive Realestate Script has XSS via the admin/general.php gplus parameter.
CVE-2017-17908 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	6.8 MEDIUM
PHP Scripts Mall Responsive Realestate Script has CSRF via admin/general.
CVE-2017-17907 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	4.3 MEDIUM
PHP Scripts Mall Car Rental Script has XSS via the admin/areaedit.php carid parameter or the admin/sitesettings.php websitename parameter.
CVE-2017-17906 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	7.5 HIGH
PHP Scripts Mall Car Rental Script has SQL Injection via the admin/carlistedit.php carid parameter.
CVE-2017-17905 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	6.8 MEDIUM
PHP Scripts Mall Car Rental Script has CSRF via admin/sitesettings.php.
CVE-2017-17904 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	3.5 LOW
FS Lynda Clone has XSS via the keywords parameter to tutorial/ or the edit_profile_first_name parameter to user/edit_profile.
CVE-2017-17893 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	4.3 MEDIUM
Readymade Video Sharing Script has XSS via the search_video.php search parameter, the viewsubs.php chnlid parameter, or the user-profile-edit.php fname parameter.
CVE-2017-17895 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	7.5 HIGH
Readymade Job Site Script has SQL Injection via the location_name array parameter to the /job URI.
CVE-2017-17894 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	6.8 MEDIUM
Readymade Job Site Script has CSRF via the /job URI.
CVE-2017-17896 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	4.3 MEDIUM
Readymade Job Site Script has XSS via the keyword parameter to the /job URI.
CVE-2017-17892 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	7.5 HIGH
Readymade Video Sharing Script has SQL Injection via the viewsubs.php chnlid parameter or the search_video.php search parameter.
CVE-2017-17891 ↗	Dec 27, 2017Wednesday, 27 December 2017, 17:08	—	6.8 MEDIUM
Readymade Video Sharing Script has CSRF via user-profile-edit.php.
CVE-2017-17828 ↗	Dec 21, 2017Thursday, 21 December 2017, 05:29	4.8 MEDIUM	3.5 LOW
Bus Booking Script has XSS via the results.php datepicker parameter or the admin/new_master.php spemail parameter.
CVE-2017-17830 ↗	Dec 21, 2017Thursday, 21 December 2017, 05:29	—	6 MEDIUM
Bus Booking Script has CSRF via admin/new_master.php.
CVE-2017-17829 ↗	Dec 21, 2017Thursday, 21 December 2017, 05:29	—	6.5 MEDIUM
Bus Booking Script has SQL Injection via the admin/view_seatseller.php sp_id parameter or the admin/view_member.php memid parameter.
CVE-2017-17778 ↗	Dec 20, 2017Wednesday, 20 December 2017, 03:29	—	3.5 LOW
Paid To Read Script 2.0.5 has XSS via the referrals.php tier parameter or the admin/userview.php uid parameter.
CVE-2017-17779 ↗	Dec 20, 2017Wednesday, 20 December 2017, 03:29	—	7.5 HIGH
Paid To Read Script 2.0.5 has SQL injection via the referrals.php id parameter.
CVE-2017-17777 ↗	Dec 20, 2017Wednesday, 20 December 2017, 03:29	—	7.5 HIGH
Paid To Read Script 2.0.5 has authentication bypass in the admin panel via a direct request, as demonstrated by the admin/viewvisitcamp.php fn parameter and the admin/userview.php uid parameter.
CVE-2017-17776 ↗	Dec 20, 2017Wednesday, 20 December 2017, 03:29	—	5 MEDIUM
Paid To Read Script 2.0.5 has full path disclosure via an invalid admin/userview.php uid parameter.
CVE-2017-17775 ↗	Dec 20, 2017Wednesday, 20 December 2017, 03:29	—	4.3 MEDIUM
Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request.
CVE-2017-17774 ↗	Dec 20, 2017Wednesday, 20 December 2017, 03:29	—	6.8 MEDIUM
admin/configuration.php in Piwigo 2.9.2 has CSRF.
CVE-2017-17696 ↗	Dec 15, 2017Friday, 15 December 2017, 09:29	—	4 MEDIUM
Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php.
CVE-2017-17695 ↗	Dec 15, 2017Friday, 15 December 2017, 09:29	—	6.5 MEDIUM
Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter.
CVE-2017-17694 ↗	Dec 15, 2017Friday, 15 December 2017, 09:29	—	3.5 LOW
Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter.
CVE-2017-17693 ↗	Dec 15, 2017Friday, 15 December 2017, 09:29	—	4 MEDIUM
Techno - Portfolio Management Panel through 2017-11-16 does not check authorization for panel/portfolio.php?action=delete requests that remove feedback.
CVE-2017-17567 ↗	Dec 13, 2017Wednesday, 13 December 2017, 09:29	—	5 MEDIUM
Scubez Posty Readymade Classifieds has SQL Injection via the admin/user_activate_submit.php ID parameter.
CVE-2017-17569 ↗	Dec 13, 2017Wednesday, 13 December 2017, 09:29	—	4.3 MEDIUM
Scubez Posty Readymade Classifieds has XSS via the admin/user_activate_submit.php ID parameter.
CVE-2017-17568 ↗	Dec 13, 2017Wednesday, 13 December 2017, 09:29	—	5 MEDIUM
Scubez Posty Readymade Classifieds has Incorrect Access Control for visiting admin/user_activate_submit.php (aka the backend PHP script), which might allow remote attackers to obtain sensitive information via a direct request.