CVE-2019-3963

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patientid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3965: Improper Neutralization of Input During Web Page Generation

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the documentid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3966: Improper Neutralization of Input During Web Page Generation

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreignid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3963: Improper Neutralization of Input During Web Page Generation

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patientid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

PT-2019-16812

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.1 and earlier Description The issue is related to a reflected XSS vulnerability. This vulnerability is located in the controller.php file and is associated with the patient id parameter. It could allow an attacker to execu...

PT-2019-16814

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.1 and earlier Description The issue is related to a reflected XSS vulnerability. This vulnerability is located in the controller.php file and is associated with the document id parameter. It could allow an attacker to...

PT-2019-16815

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.1 and earlier Description The issue concerns a reflected XSS vulnerability. This vulnerability is located in the controller.php file and is related to the foreign id parameter. It could allow an attacker to execute arbitra...

CVE-2019-3964: Improper Neutralization of Input During Web Page Generation

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the docid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

PT-2019-16813

Name of the Vulnerable Software and Affected Versions OpenEMR versions 5.0.1 and earlier Description The issue concerns a reflected XSS vulnerability. This vulnerability is located in the controller.php file and is related to the doc id parameter. It could allow an attacker to execute arbitrary...

CVE-2018-18802: Cross-Site Request Forgery (CSRF)

The Tubigan "Welcome to our Resort" 1.0 software allows CSRF via admin/modusers/controller.php?action=edit...

PT-2019-9633

Name of the Vulnerable Software and Affected Versions Tubigan "Welcome to our Resort" version 1.0 Description The issue allows for CSRF, which can be exploited via the "admin/mod users/controller.php?action=edit" API endpoint. This could potentially allow attackers to perform unauthorized actions...

CVE-2019-10647: Unrestricted Upload of File with Dangerous Type

ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source parameter because of a lack of inc/zzzfile.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if th...

PT-2019-11962

Name of the Vulnerable Software and Affected Versions ZZZCMS zzzphp version 1.6.3 Description The issue allows remote attackers to execute arbitrary PHP code via a .php URL in the "plugins/ueditor/php/controller.php?action=catchimage" API endpoint, specifically through the source parameter, due t...

Cross site request forgery (csrf)

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit...

CVE-2018-18799

School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos...

CVE-2018-18799: Cross-Site Request Forgery (CSRF)

School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos...

CVE-2018-18794: Cross-Site Request Forgery (CSRF)

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit...

CVE-2018-18793: Unrestricted Upload of File with Dangerous Type

School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos...

PT-2018-14657

Name of the Vulnerable Software and Affected Versions School Event Management System version 1.0 Description The issue allows for Arbitrary File Upload. This can be achieved via the "event/controller.php?action=photos" endpoint, specifically by exploiting the action parameter set to photos...

PT-2018-14662

Name of the Vulnerable Software and Affected Versions School Attendance Monitoring System version 1.0 Description The issue concerns a CSRF vulnerability. It affects the "event/controller.php" endpoint, specifically when the "action" parameter is set to "photos". Recommendations For School...