2584 matches found
Sql injection
DISPUTED Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass aka the reset password form. NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid...
CVE-2019-12279
Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass aka the reset password form. NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that...
CVE-2019-12279: Improper Neutralization of Special Elements used in an SQL Command
Nagios XI 5.6.1 allows SQL injection via the username parameter to login.php?forgotpass aka the reset password form. NOTE: The vendor disputes this issues as not being a vulnerability because the issue does not seem to be a legitimate SQL Injection. The POC does not show any valid injection that...
Sql injection
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...
CVE-2018-18800
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...
CVE-2018-18800: Improper Neutralization of Special Elements used in an SQL Command
The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...
PT-2019-9632
Name of the Vulnerable Software and Affected Versions Tubigan "Welcome to our Resort" version 1.0 Description The issue allows SQL Injection, which can be exploited through specific API endpoints, such as "index.php?p=accomodation&q=SQL", "index.php?p=rooms&q=SQL", or "admin/login.php"...
SOCA Access Control System 180612 - SQL Injection
SOCA Access Control System 180612 SQL Injection And Authentication Bypass Vendor: SOCA Technology Co., Ltd Product web page: http://www.socatech.com Affected version: 180612, 170000 and 141007 Summary: The company's products include proximity and fingerprint access control system, time and...
Cross site scripting
An issue was discovered in Open XDMoD through 7.5.0. html/gui/general/login.php has Reflected XSS via the xduserformalname parameter...
CVE-2018-16960
An issue was discovered in Open XDMoD through 7.5.0. html/gui/general/login.php has Reflected XSS via the xduserformalname parameter...
CVE-2018-16960: Improper Neutralization of Input During Web Page Generation
An issue was discovered in Open XDMoD through 7.5.0. html/gui/general/login.php has Reflected XSS via the xduserformalname parameter...
PT-2019-9384
Name of the Vulnerable Software and Affected Versions Open XDMoD versions prior to 7.5.0 Description An issue was discovered in Open XDMoD, where the html/gui/general/login.php endpoint has a Reflected XSS vulnerability via the xd user formal name parameter. Recommendations For Open XDMoD version...
CVE-2019-7660: Improper Neutralization of Input During Web Page Generation
An issue was discovered in PHPMyWind 5.5. The username parameter of the /install/index.php page has a stored Cross-site Scripting XSS vulnerability, as demonstrated by admin/login.php...
WordPress Cerber Security Antispam & Malware Scan 8.0 Plugin - Multiple Bypass Vulnerabilities
Exploit for php platform in category web applications Exploit Title: WordPress Cerber Security, Antispam & Malware Scan - Multiple Bypass Vulnerabilities Type: WordPress Plugin Active installs: 100,000+ Version: 8.0 Software Link: https://wordpress.org/plugins/wp-cerber/ Exploit Author: ed0x21son...
PT-2019-19008
Name of the Vulnerable Software and Affected Versions Hotels Server versions prior to 2018-11-05 Description The issue is related to SQL Injection, which occurs due to the mishandling of the telephone parameter in the "controller/api/login.php" API endpoint. This allows for potential exploitation...
CVE-2019-8393: Improper Neutralization of Special Elements used in an SQL Command
HotelsServer through 2018-11-05 has SQL Injection via the API because the controller/api/login.php telephone parameter is mishandled...
CVE-2018-19414: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to inject arbitrary web script or HTML via the 1 keyword parameter to groups.php; 2 username parameter to login.php; or 3 date parameter to search.php...
PT-2019-9804
Name of the Vulnerable Software and Affected Versions Plikli CMS version 4.0.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in various PHP files. The...
PT-2018-9590
Name of the Vulnerable Software and Affected Versions: WeBid versions up to 1.2.2 Description: The issue allows for Javascript execution in the user's browser and injection of malicious markup into the page due to a Cross Site Scripting XSS vulnerability in files such as user login.php and...