Browse / ExpressionEngine

ExpressionEngine

See its reports on the map

What gets reported to ExpressionEngine

• Code Execution9
• Cross-site Scripting7
• Path Traversal3
• Cross-Site Request Forgery3
• Information Disclosure3
• Open Redirect3

Most upvoted reports

AllValidInformativeN/ADuplicate

1. SQL injection in structure pluginSQL Injection · medium
   125 votes
2. Type Juggling -> PHP Object Injection -> SQL Injection ChainCryptographic Issues - Generic
   40 votes
3. Non-authenticated path traversal leading to arbitrary file read Path Traversal · high
   34 votes
4. Multiple XSS and open HTTP redirectionCross-site Scripting (XSS) - Stored · high
   29 votes
5. Arbitrary comment content change with GET CSRF. Cross-Site Request Forgery (CSRF) · low
   27 votes
6. Stored XSS filter bypass on discussion forum. "URL" tag. Cross-site Scripting (XSS) - Stored · medium
   26 votes
7. Comment/channel unsubscribe GET CSRFCross-Site Request Forgery (CSRF) · low
   23 votes
8. Arbitrary forum topic close with GET CSRF.Cross-Site Request Forgery (CSRF) · low
   23 votes
9. Import/Convert user file exposure leading to logins/passwords/PII leak. Insecure Storage of Sensitive Information · low
   22 votes
10. Low privileges (auth) Remote Command Execution - PHP file upload bypass.Code Injection · high
    22 votes
11. RCE By import channel fieldCommand Injection - Generic · high
    21 votes
12. Stored XSS filter bypass on discussion forum. Cross-site Scripting (XSS) - Stored · low
    19 votes
13. PHP Code Injection through "Translate::save()" methodCode Injection · medium
    19 votes
14. Authenticated RCE via page titleCode Injection · medium
    14 votes
15. PHP Object injection -> Building Custom Gadget chain -> RCE Command Injection - Generic · high
    11 votes
16. License verification mechanism can be bypassedUse of a Broken or Risky Cryptographic Algorithm · low
    11 votes
17. [EE] change the author of post using the author_idInsecure Direct Object Reference (IDOR) · low
    11 votes
18. Persistent XSS via malicious license fileCross-site Scripting (XSS) - Stored · medium
    9 votes
19. SQL injection at /admin.php?/cp/members/createSQL Injection · medium
    8 votes
20. XML Member Proccessing - Local File inclusion Vulnerability Path Traversal · low
    8 votes
21. Open Redirect in comment sectionOpen Redirect · low
    7 votes
22. [EE] Spoof the redirect processOpen Redirect · low
    7 votes
23. Remote Code Execution in the Import Channel functionCode Injection · medium
    7 votes
24. Import File Converter - local File inclusion Path Traversal · low
    6 votes
25. Arbitrary file upload when setting an avatarCode Injection
    6 votes
26. Open redirects protection bypassOpen Redirect · medium
    5 votes
27. Reflective XSSCross-site Scripting (XSS) - Generic
    4 votes
28. Arbitrary SQL query execution and reflected XSS in the "SQL Query Form"Uncontrolled Resource Consumption
    4 votes
29. Image lib - unescaped file pathCode Injection · medium
    3 votes
30. Full path + some back-end code disclosureInformation Disclosure
    3 votes
31. Potential code injection in fun delete_directoryCode Injection · medium
    2 votes
32. Filename and directory enumerationInformation Disclosure
    2 votes
33. Cross Site Scripting (Stored) Cross-site Scripting (XSS) - Generic
    2 votes
34. Stored Cross-Site Scripting Vulnerability in /admin.php?/cp/admin_system/general_configurationCross-site Scripting (XSS) - Generic
    1 votes