PT-2020-10498

Name of the Vulnerable Software and Affected Versions ilchCMS version 2.1.23 Description The issue allows for XSS via the Link parameter in the "index.php/partner/index" endpoint. Recommendations For ilchCMS version 2.1.23, avoid using the Link parameter in the "index.php/partner/index" endpoint...

PT-2020-10499

Name of the Vulnerable Software and Affected Versions ilchCMS version 2.1.23 Description The issue allows for XSS via the Name parameter in the "index.php/partner/index" endpoint. Recommendations For ilchCMS version 2.1.23, avoid using the Name parameter in the "index.php/partner/index" endpoint...

PT-2020-10500

Name of the Vulnerable Software and Affected Versions ilchCMS version 2.1.23 Description The issue allows for XSS via the index.php/partner/index API endpoint, specifically through the Banner parameter. Recommendations For ilchCMS version 2.1.23, avoid using the Banner parameter in the...

CVE-2019-20522: Improper Neutralization of Input During Web Page Generation

ilchCMS 2.1.23 allows XSS via the index.php/partner/index Link parameter...

CVE-2019-20523: Improper Neutralization of Input During Web Page Generation

ilchCMS 2.1.23 allows XSS via the index.php/partner/index Name parameter...

CVE-2019-20524: Improper Neutralization of Input During Web Page Generation

ilchCMS 2.1.23 allows XSS via the index.php/partner/index Banner parameter...

CVE-2020-10218

The CVE-2020-10218 entry pertains to Sapplica Sentrifugo 3.2, where a Blind SQL Injection vulnerability exists in the index.php/holidaygroups/add id parameter caused by the HolidaydatesController.php addAction function. The issue allows an attacker to read data from the application’s database. Pu...

CVE-2020-10218: Improper Neutralization of Special Elements used in an SQL Command

A Blind SQL Injection issue was discovered in Sapplica Sentrifugo 3.2 via the index.php/holidaygroups/add id parameter because of the HolidaydatesController.php addAction function...

PT-2020-11979

Name of the Vulnerable Software and Affected Versions Sapplica Sentrifugo version 3.2 Description A Blind SQL Injection issue was discovered in the software. The issue is related to the addAction function in the HolidaydatesController.php file. It can be exploited via the id parameter in the...

CVE-2020-10415

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/index.php by adding a question mark ? followed by the payload...

CVE-2020-10415

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/index.php by adding a question mark ? followed by the payload...

CVE-2020-10415: Improper Neutralization of Input During Web Page Generation

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/index.php by adding a question mark ? followed by the payload...

Joomla! Component com_newsfeeds 1.0 - 'feedid' SQL Injection

Exploit Title: Joomla! Component comnewsfeeds 1.0 - 'feedid' SQL Injection Date: 2020-03-10 Author: Milad Karimi Software Link: Version: Category : webapps Tested on: windows 10 , firefox CVE : CWE-89 Dork: inurl:index.php?option=comnewsfeeds...

CVE-2015-7338

SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocationlongitude request to index.php...

CVE-2015-7338

SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocationlongitude request to index.php...

60CycleCMS - news.php SQL Injection

60CycleCMS - news.php SQL Injection Exploit Title: 60CycleCMS - 'news.php' Multiple vulnerability Google Dork: N/A Date: 2020-02-10 Exploit Author: Unkn0wn Vendor Homepage: http://davidvg.com/ Software Link: https://www.opensourcecms.com/60cyclecms Version: 2.5.2 Tested on: Ubuntu CVE : N/A...

PT-2020-7882

Name of the Vulnerable Software and Affected Versions: AcyMailing Joomla Component versions prior to 4.9.5 Description: The issue is related to SQL Injection in the AcyMailing Joomla Component. It can be exploited via the exportgeolocorder in a geolocation longitude request to "index.php"...

CVE-2015-7338: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocationlongitude request to index.php...

CVE-2020-10106

CVE-2020-10106 affects PHPGurukul Daily Expense Tracker System 1.0. The Red Hat/NVD entries confirm a SQL injection via the email parameter in index.php or register.php, enabling dumping of the MySQL database and bypassing the login prompt. The vulnerability is driven by improper handling of user...

PT-2020-11930

Name of the Vulnerable Software and Affected Versions PHPGurukul Daily Expense Tracker System version 1.0 Description The issue allows for SQL injection, as demonstrated by the email parameter in "index.php" or "register.php", enabling the dumping of the MySQL database and bypassing the login...