CVE-2022-26180: Cross-Site Request Forgery (CSRF)

qdPM 9.2 allows Cross-Site Request Forgery CSRF via the index.php/myAccount/update URI...

PT-2022-18741

Name of the Vulnerable Software and Affected Versions Movie Seat Reservation version 1 Description The issue is related to a SQL injection vulnerability. It affects the "/index.php?page=reserve" API endpoint via the id parameter. Recommendations For Movie Seat Reservation version 1, as a temporar...

PT-2022-18742

Name of the Vulnerable Software and Affected Versions Movie Seat Reservation version 1 Description The issue is related to an unauthenticated file disclosure vulnerability. This vulnerability can be exploited via the "/index.php?page=home" API endpoint. Recommendations For Movie Seat Reservation...

PT-2022-18386

Name of the Vulnerable Software and Affected Versions Ecommece-Website version 1.1.0 Description The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability. This is achieved through the "/admin/index.php?slides" API endpoint...

CVE-2022-27108

OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...

CVE-2022-27108: Authorization Bypass Through User-Controlled Key

OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...

PT-2022-18225

Name of the Vulnerable Software and Affected Versions OrangeHRM version 4.10 Description The issue allows any user to create a timesheet in another user's account due to an Insecure Direct Object Reference IDOR via the endpoint "symfony/web/index.php/time/createTimesheet". Recommendations For...

PT-2022-18426

Name of the Vulnerable Software and Affected Versions Ecommerce-Website version 1.1.0 Description The issue allows attackers to upload a webshell via the Product Image component due to an unrestricted file upload at the "/public/admin/index.php?add product" API endpoint. Recommendations For...

PT-2022-18427

Name of the Vulnerable Software and Affected Versions Ecommerce-Website version 1.1.0 Description A cross-site scripting XSS issue exists in the /public/admin/index.php?add user endpoint, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username...

CVE-2022-27436: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in /public/admin/index.php?adduser at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username text field...

CVE-2021-43478

A vulnerability exists in Hoosk 1.8.0 in /install/index.php, due to a failure to check if config.php already exists in the root directory, which could let a malicious user reinstall the website...

Cross site scripting

A Cross Site Scripting XSS vulnerability exists in DanPros htmly 2.8.1 via the Description field in 1 admin/config, and 2 index.php pages...

CVE-2021-42867

A Cross Site Scripting XSS vulnerability exists in DanPros htmly 2.8.1 via the Description field in 1 admin/config, and 2 index.php pages...

Cross-site Scripting (XSS)

phpLiteAdmin is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization of input via the index.php newRows parameter aka num or number...

CVE-2022-1191

SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96...

Sourcecodester Student Attendance Management System跨站脚本漏洞

Sourcecodester Student Attendance Management System is an attendance management system used to maintain daily attendance records. A cross-site scripting vulnerability exists in Sourcecodester Student Attendance Management System version 1.0. The vulnerability stems from a lack of data validation...

CVE-2021-43478: Undefined Security Weakness

A vulnerability exists in Hoosk 1.8.0 in /install/index.php, due to a failure to check if config.php already exists in the root directory, which could let a malicious user reinstall the website...

PT-2022-11853

Name of the Vulnerable Software and Affected Versions Hoosk version 1.8.0 Description A vulnerability exists due to a failure to check if config.php already exists in the root directory, which could let a malicious user reinstall the website. This issue is related to the /install/index.php...

CVE-2022-1191: Server-Side Request Forgery (SSRF)

SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96...

CVE-2021-42867: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS vulnerability exists in DanPros htmly 2.8.1 via the Description field in 1 admin/config, and 2 index.php pages...