CVE-2021-38334

The WP Design Maps & Places WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the /wpdmp-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

CVE-2021-38334: Improper Neutralization of Input During Web Page Generation

The WP Design Maps & Places WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the filename parameter found in the /wpdmp-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

PT-2021-22079

Name of the Vulnerable Software and Affected Versions WordPress InviteBox Plugin versions up to and including 1.4.1 Description The WordPress InviteBox Plugin is affected by a Reflected Cross-Site Scripting issue. This is due to the message parameter in the /admin/admin.php file, which allows...

PT-2021-22053

Name of the Vulnerable Software and Affected Versions: WP Design Maps & Places WordPress plugin versions up to and including 1.2 Description: The issue allows attackers to inject arbitrary web scripts via the filename parameter in the /wpdmp-admin.php file, enabling Reflected Cross-Site Scripting...

PT-2021-22069

Name of the Vulnerable Software and Affected Versions Moneybird for WooCommerce WordPress plugin versions up to and including 2.1.1 Description The issue allows attackers to inject arbitrary web scripts via the error description parameter found in the /templates/wcmb-admin.php file, enabling...

CVE-2021-38359: Improper Neutralization of Input During Web Page Generation

The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter found in the /admin/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.1...

CVE-2021-38349: Improper Neutralization of Input During Web Page Generation

The Integration of Moneybird for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the errordescription parameter found in the /templates/wcmb-admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1...

CF Geo Plugin < 7.13.12 - Reflected Cross-Site Scripting

The plugin does not escape the some parameter before outputting them back in admin pages, leading to a Reflected Cross-Site Scripting issue POST /wp-admin/admin.php?page=cf-geoplugin-activate HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Accept-Language...

Sql injection

SQL Injection vulnerability in cxuucms 3.1 ivia the pid parameter in public/admin.php...

CVE-2021-3264

SQL Injection vulnerability in cxuucms 3.1 ivia the pid parameter in public/admin.php...

Electron Technologies FZC PopojiCMS Cross-Site Request Forgery Vulnerability

Electron Technologies FZC PopojiCMS is an open source content management system CMS based on the Popoji framework from Electron Technologies FZC. version 2.0.1 of Electron Technologies FZC PopojiCMS admin.php is vulnerable to cross-site request forgery. No detailed vulnerability details are...

PT-2021-19824

Name of the Vulnerable Software and Affected Versions cxuucms version 3.1 Description The issue is related to a SQL Injection vulnerability. It affects the pid parameter in the "public/admin.php" endpoint. There is no information provided about the estimated number of potentially affected devices...

CVE-2021-3264: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in cxuucms 3.1 ivia the pid parameter in public/admin.php...

CVE-2020-19821

A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders parameter...

CVE-2020-19821

A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders parameter...

Sql injection

A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders parameter...

CVE-2020-19821

DOYO CMS (DOYOCMS) 2.3 contains a SQL injection in admin.php reachable via the orders[] parameter, allowing attackers to execute arbitrary SQL commands. Root cause: improper handling/sanitization of the orders[] input leads to injection. Affected component: DOYOCMS 2.3; entry describes high-sever...

CVE-2020-19821

A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders parameter...

CVE-2020-19821: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders parameter...

PT-2021-10413

Name of the Vulnerable Software and Affected Versions: DOYOCMS version 2.3 Description: A SQL injection issue in the admin.php file allows attackers to execute arbitrary SQL commands via the orders parameter. Recommendations: For DOYOCMS version 2.3, consider restricting access to the admin.php...