167 matches found
Sql injection
A SQL injection vulnerability exists with user privileges in interface/forms/eyemag/save.php in OpenEMR 5.0.2.1...
CVE-2021-32104
A SQL injection vulnerability exists with user privileges in interface/forms/eyemag/save.php in OpenEMR 5.0.2.1...
PT-2021-19670
Name of the Vulnerable Software and Affected Versions: OpenEMR version 5.0.2.1 Description: A SQL injection issue exists in the interface/forms/eye mag/save.php file, allowing exploitation with user privileges. Recommendations: For OpenEMR version 5.0.2.1, consider restricting access to the...
CVE-2021-32104: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists with user privileges in interface/forms/eyemag/save.php in OpenEMR 5.0.2.1...
PT-2021-17344
Name of the Vulnerable Software and Affected Versions: BlackCat CMS version 1.3.6 Description: The issue concerns stored XSS in the admin panel of BlackCat CMS, specifically via the Display Name field. This occurs when an admin interacts with the "backend/preferences/ajax save.php" endpoint...
Sql injection
WebsiteBaker 2.12.2 allows SQL Injection via parameter 'displayname' in /websitebaker/admin/preferences/save.php. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...
WebsiteBaker 2.12.2 SQL Injection
Exploit Title: WebsiteBaker 2.12.2 - 'displayname' SQL Injection authenticated Google Dork: - Date: 2020-09-20 Exploit Author: Roel van Beurden Vendor Homepage: https://websitebaker.org Software Link: https://wiki.websitebaker.org/doku.php/en/downloads Version: 2.12.2 Tested on: Linux Ubuntu 18.0...
PT-2020-16264
Name of the Vulnerable Software and Affected Versions WebsiteBaker version 2.12.2 Description The issue allows SQL Injection via the display name parameter in the "/websitebaker/admin/preferences/save.php" API endpoint. This could enable an attacker to compromise the application, access or modify...
CVE-2020-25990: Improper Neutralization of Special Elements used in an SQL Command
WebsiteBaker 2.12.2 allows SQL Injection via parameter 'displayname' in /websitebaker/admin/preferences/save.php. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...
PT-2020-15587
Name of the Vulnerable Software and Affected Versions LibreHealth EHR version 2.0.0 Description The issue allows remote attackers to achieve remote code execution RCE on the hosting webserver by uploading a maliciously crafted image through the interface/new/new comprehensive save.php file. This ...
CVE-2020-12707
An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT elements. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT elements...
CVE-2020-12707
An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT elements. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT elements...
CVE-2020-12707
An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT elements. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT elements...
PT-2020-13219
Name of the Vulnerable Software and Affected Versions LeptonCMS version 4.5.0 Description A security issue exists due to insufficient protection against cross-site scripting XSS attacks in the modules/wysiwyg/save.php file. The current security measure only strips SCRIPT elements, which can be...
CVE-2020-12707: Improper Neutralization of Input During Web Page Generation
An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT elements. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT elements...
CVE-2019-14529
OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eyemag/save.php...
CVE-2019-14529
OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eyemag/save.php...
Sql injection
OpenEMR before 5.0.2 allows SQL Injection in interface/forms/eyemag/save.php...