PT-2020-16184

Name of the Vulnerable Software and Affected Versions paGO Commerce plugin version 2.5.9.0 for Joomla! Description The issue allows SQL Injection via the "administrator/index.php?option=com pago&view=comments" API endpoint, specifically through the filter published parameter. Recommendations For...

Projectworlds House Rental SQL Injection Vulnerability

Projectworlds House Rental is a system used by the Projectworlds organization for house rental functionality. version 1.0 of Projectworlds House Rental is vulnerable to SQL injection, which can be exploited by remote attackers to make POST requests via a malicious index.php...

CVE-2020-23833

Projectworlds House Rental v1.0 suffers from an unauthenticated SQL Injection vulnerability, allowing remote attackers to execute arbitrary code on the hosting webserver via a malicious index.php POST request...

CVE-2020-23833: Improper Neutralization of Special Elements used in an SQL Command

Projectworlds House Rental v1.0 suffers from an unauthenticated SQL Injection vulnerability, allowing remote attackers to execute arbitrary code on the hosting webserver via a malicious index.php POST request...

PT-2020-15591

Name of the Vulnerable Software and Affected Versions Projectworlds House Rental version 1.0 Description The issue allows remote attackers to execute arbitrary code on the hosting webserver. This is achieved through an unauthenticated SQL Injection vulnerability via a malicious index.php POST...

CVE-2020-23839

A Reflected Cross-Site Scripting XSS vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the logi...

CVE-2020-23831: Improper Neutralization of Input During Web Page Generation

A Reflected Cross-Site Scripting XSS vulnerability in the index.php login-portal webpage of SourceCodester Stock Management System v1.0 allows remote attackers to harvest login credentials and session cookies when an unauthenticated victim clicks on a malicious URL and enters credentials...

CVE-2020-23835: Improper Neutralization of Input During Web Page Generation

A Reflected Cross-Site Scripting XSS vulnerability in the index.php login-portal webpage of SourceCodester Tailor Management System v1.0 allows remote attackers to harvest keys pressed by an unauthenticated victim who clicks on a malicious URL and begins typing...

PT-2020-15589

Name of the Vulnerable Software and Affected Versions SourceCodester Stock Management System version 1.0 Description A Reflected Cross-Site Scripting XSS issue in the index.php login-portal webpage allows remote attackers to harvest login credentials and session cookies when an unauthenticated...

CVE-2020-23839: Improper Neutralization of Input During Web Page Generation

A Reflected Cross-Site Scripting XSS vulnerability in GetSimple CMS v3.3.16, in the admin/index.php login portal webpage, allows remote attackers to execute JavaScript code in the client's browser and harvest login credentials after a client clicks a link, enters credentials, and submits the logi...

CVE-2020-6637

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php...

Sql injection

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php...

CVE-2020-6637

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php...

CVE-2020-6637

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php...

CVE-2020-6637

OpenSIS Community Edition 7.3 is affected by CVE-2020-6637: a SQL injection through the USERNAME parameter in index.php. The Nuclei template confirms SQLi in OpenSIS 7.3 and describes the impact as the ability to execute arbitrary SQL queries, potentially leading to data access or manipulation. T...

CVE-2020-19889

DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for index.php?dbhcmspid=-70 can add a user...

CVE-2020-6637: Improper Neutralization of Special Elements used in an SQL Command

openSIS Community Edition version 7.3 is vulnerable to SQL injection via the USERNAME parameter of index.php...

CVE-2020-19889: Cross-Site Request Forgery (CSRF)

DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for index.php?dbhcmspid=-70 can add a user...

PT-2020-15215

Name of the Vulnerable Software and Affected Versions DBHcms version 1.2.0 Description The issue concerns the lack of a CSRF protection mechanism. This can be demonstrated through a CSRF attack on the "index.php?dbhcms pid=-70" endpoint, which allows adding a user. Recommendations For DBHcms...

PT-2020-19198

Name of the Vulnerable Software and Affected Versions openSIS Community Edition version 7.3 Description The issue allows for SQL injection via the USERNAME parameter of the "index.php" endpoint. Recommendations For openSIS Community Edition version 7.3, avoid using the USERNAME parameter in the...