41 matches found
Geo Mashup <= 1.13.18 - SQL Injection
Geo Mashup WordPress plugin = 1.13.18 is vulnerable to time-based SQL injection via the sort parameter. The issue exists because the sort value is insufficiently sanitized in render-map.php/template tag code paths. id: CVE-2026-4060 info: name: Geo Mashup = 1.13.18 - SQL Injection author:...
Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)
Verified against: getgrav/grav devel branch, GRAVVERSION = "2.0.15", file index.php Title Unauthenticated Path Traversal via Missing Directory-Boundary Check in plugin-asset-map.php Static Asset Server index.php Product / Affected Versions - Product: getgrav/grav - File: index.php top-level front...
GHSA-4V9Q-P283-QC2M Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)
Verified against: getgrav/grav devel branch, GRAVVERSION = "2.0.15", file index.php Title Unauthenticated Path Traversal via Missing Directory-Boundary Check in plugin-asset-map.php Static Asset Server index.php Product / Affected Versions - Product: getgrav/grav - File: index.php top-level front...
Directory Traversal
Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Directory Traversal via the plugin-asset-map.php process. An attacker can access files outside the intended directory by crafting requests tha...
Duplicate Advisory: Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4v9q-p283-qc2m. This link is maintained to preserve external references. Original Description Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses stri...
CVE-2026-4060: Improper Neutralization of Special Elements used in an SQL Command
The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'sort' parameter in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The escsql functi...
CVE-2026-4062: Improper Neutralization of Special Elements used in an SQL Command
The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'objectids' and 'excludeobjectids' parameters in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existin...
EUVD-2008-6392
Malware in sbrugna...
EUVD-2019-18493
Malware in sbrugna...
EUVD-2020-7163
Malware in sbrugna...
EUVD-2025-32458
A security flaw has been discovered in ixmaps website2017 up to 0c71cffa0162186bc057a76766bc97e9f5a3a2d0. This impacts an unknown function of the file /map.php of the component HTTP GET Request Handler. Performing manipulation of the argument trid results in cross site scripting. The attack can b...
ixmaps.ca website 安全漏洞
ixmaps.ca website is a website page of ixmaps open source. A security vulnerability exists in ixmaps.ca website, which stems from an incorrect manipulation of the parameter trid in the file /map.php, which could lead to a cross-site scripting attack...
PT-2025-40807
Name of the Vulnerable Software and Affected Versions ixmaps website2017 versions prior to 0c71cffa0162186bc057a76766bc97e9f5a3a2d0 Description A security flaw exists that allows for cross site scripting. The issue is related to the manipulation of the trid argument within an HTTP GET request...
CVE-2025-11291: Improper Neutralization of Input During Web Page Generation
A security flaw has been discovered in ixmaps website2017 up to 0c71cffa0162186bc057a76766bc97e9f5a3a2d0. This impacts an unknown function of the file /map.php of the component HTTP GET Request Handler. Performing manipulation of the argument trid results in cross site scripting. The attack can b...
CVE-2020-15035
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Map.php hde parameter...
CVE-2020-15028
NeDi 1.9C is vulnerable to a cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Topology-Map.php xo parameter...
Cross site scripting
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Monitoring-Map.php hde parameter...
CVE-2020-15028
NeDi 1.9C is vulnerable to a cross-site scripting (XSS) flaw. The issue allows an attacker to execute arbitrary JavaScript via the Topology-Map.php page parameter xo. This appears consistently across multiple feeds (NVD, CNVD, PRION, OpenVAS) and is described as a web-application XSS without evid...
CVE-2020-15035
CVE-2020-15035 affects NeDi 1.9C, where a Cross-Site Scripting (XSS) flaw exists in the Monitoring-Map.php page via the hde parameter. The vulnerability allows an attacker to inject and execute arbitrary JavaScript in the victim’s browser, as described across multiple sources (NVD/CNVD/PRION/CVE ...
