CVE-2018-8047: Improper Neutralization of Input During Web Page Generation

vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting XSS vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List app parameter...

CVE-2019-12593: Improper Limitation of a Pathname to a Restricted Directory

IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index.php?style=..%5c directory traversal...

PT-2019-12881

Name of the Vulnerable Software and Affected Versions IceWarp Mail Server versions prior to 10.4.5 Description The issue is related to a local file inclusion vulnerability. This can be exploited via the /webmail/calendar/minimizer/index.php API endpoint, specifically by manipulating the style...

CVE-2019-9106

The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to execute or include local .php files, as demonstrated by menu=php://filter/convert.base64-encode/resource=index.php to read index.php...

Joomla and WordPress Found Harboring Malicious Redirect Code

Security researchers are warning owners of Joomla and WordPress websites of a malicious redirect script that is pushing visitors to malicious websites. On Thursday, Eugene Wozniak, a security researcher with Sucuri, published a report outlining a rogue hypertext access .htaccess injector found on...

CVE-2019-11876

In PrestaShop 1.7.5.2, the shopcountry parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup accepting terms and conditions before executing the malicious link...

PT-2019-12536

Name of the Vulnerable Software and Affected Versions PrestaShop version 1.7.5.2 Description The issue concerns a Reflected XSS affecting the shop country parameter in the install/index.php installation script/component. Exploitation requires a user to follow the initial setup stages, including...

PT-2019-7547

Name of the Vulnerable Software and Affected Versions osClass version 3.6.1 Description The issue allows for directory traversal via the plugin parameter, which can be exploited for remote PHP code execution. An administrator can upload an image containing PHP code in the EXIF data through the...

CVE-2019-11876: Improper Neutralization of Input During Web Page Generation

In PrestaShop 1.7.5.2, the shopcountry parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup accepting terms and conditions before executing the malicious link...

Sql injection

Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=startpulling&id= substring...

CVE-2019-10852

Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=startpulling&id= substring...

CVE-2019-10852: Improper Neutralization of Special Elements used in an SQL Command

Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=startpulling&id= substring...

PT-2019-12056

Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue allows authenticated blind SQL injection via the id GET parameter in the "index.php?m=servers&a=start pulling&id=" endpoint. This can be exploited as demonstrated by injecting a substring in...

Sql injection

sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadminceditpost cvalue parameter...

PT-2019-12718

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue allows SQL Injection via the cvalue parameter in the "index.php?do=sadmin ceditpost" endpoint. Recommendations For UCMS version 1.4.7, avoid using the cvalue parameter in the "index.php?do=sadmin...

CVE-2019-12251: Improper Neutralization of Special Elements used in an SQL Command

sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadminceditpost cvalue parameter...

Sql injection

The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...

CVE-2018-18800

The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...

PT-2019-9632

Name of the Vulnerable Software and Affected Versions Tubigan "Welcome to our Resort" version 1.0 Description The issue allows SQL Injection, which can be exploited through specific API endpoints, such as "index.php?p=accomodation&q=SQL", "index.php?p=rooms&q=SQL", or "admin/login.php"...

CVE-2018-18800: Improper Neutralization of Special Elements used in an SQL Command

The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...