13454 matches found
CVE-2022-29316: Improper Neutralization of Special Elements used in an SQL Command
Complete Online Job Search System v1.0 was discovered to contain a SQL injection vulnerability via /eris/index.php?q=result&searchfor=advancesearch...
PT-2022-19534
Name of the Vulnerable Software and Affected Versions Complete Online Job Search System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the /eris/index.php?q=result&searchfor=advancesearch endpoint, specifically through the...
Incorrect Permission Assignment for Critical Resource in ShopXO
ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php...
PT-2022-18377
Name of the Vulnerable Software and Affected Versions E-Commerce Website version 1.0 Description A cross-site scripting XSS issue in the "/public/admin/index.php?add product" API endpoint allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Tit...
CVE-2022-28056
ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php...
CVE-2022-28056
ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php...
CVE-2022-28056
ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php...
CVE-2022-28056: Undefined Security Weakness
ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php...
CVE-2022-28918
GreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=plugindelhandle&pluginname=...
CVE-2022-28918
GreenCMS v2.3.0603 is affected by an arbitrary file deletion vulnerability exploitable over the network via /index.php?m=admin&c=custom&a=plugindelhandle&plugin_name=. The CVE entry indicates this allows deletion of arbitrary files, with CVSSv3.1 base score 8.1 (HIGH) and a network attack vector;...
CVE-2022-28918
GreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=plugindelhandle&pluginname=...
CVE-2022-28528
bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit...
CVE-2022-28523
HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete...
CVE-2022-28522
ZCMS v20170206 contains a stored XSS vulnerability in index.php?m=home&c=message&a=add. The root cause is a stored cross-site scripting flaw in the message add endpoint, allowing injection that can affect other users. According to the provided sources, the impact is C=L/I=L (partial integrity imp...
CVE-2022-28521
CVE-2022-28521 affects ZCMS v20170206 (thinkphp-zcms). The vulnerability is a file inclusion flaw in index.php?m=home&c=home&a=sp_set_config that can lead to arbitrary code execution. Several sources (NVD, CNVD/CNNVD, Red Hat, PRION) corroborate the file inclusion risk; exploitation status is not...
CVE-2022-28521
ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=spsetconfig...
CVE-2022-28522: Improper Neutralization of Input During Web Page Generation
ZCMS v20170206 was discovered to contain a stored cross-site scripting XSS vulnerability via index.php?m=home&c=message&a=add...
PT-2022-19062
Name of the Vulnerable Software and Affected Versions ZCMS version v20170206 Description A stored cross-site scripting XSS issue was found in ZCMS. The issue is exploited via the index.php endpoint with specific parameters: m=home, c=message, and a=add. This allows for malicious script execution...
CVE-2022-28523: Improper Limitation of a Pathname to a Restricted Directory
HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete...