662 matches found
PT-2021-16967
Name of the Vulnerable Software and Affected Versions SourceCodester CASAP Automated Enrollment System version 1.0 Description The issue allows remote attackers to execute arbitrary SQL statements. This is achieved via the id parameter to the "edit user.php" endpoint. Recommendations For...
in beestat/app
✍️ Description The random number generator implemented by mtrand cannot withstand a cryptographic attack. In this case the function that generates weak random numbers is mtrand in user.php at line 58. 🕵️♂️ Proof of Concept Vulnerable Code / Create an anonymous user so we can log in and have access...
CVE-2020-20640
Cross Site Scripting XSS vulnerability in ECShop 4.0 due to security filtering issues, in the user.php file, we can use the html entity encoding to bypass the security policy of the safety.php file, triggering the xss vulnerability...
PT-2021-10518
Name of the Vulnerable Software and Affected Versions: ECShop version 4.0 Description: The issue is related to a Cross Site Scripting XSS vulnerability due to security filtering issues. Specifically, in the user.php file, it is possible to use HTML entity encoding to bypass the security policy...
CVE-2020-20640: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in ECShop 4.0 due to security filtering issues, in the user.php file, we can use the html entity encoding to bypass the security policy of the safety.php file, triggering the xss vulnerability...
in phpservermon/phpservermon
✍️ Description The random number generator implemented by mtrand cannot withstand a cryptographic attack. Insecure randomness errors occur when a function that can produce predictable values is used as a source of randomness in security-sensitive context. In this case the function that generates...
PT-2021-10498
Name of the Vulnerable Software and Affected Versions: White Shark System WSS version 1.3.2 Description: The issue arises from the failure of certain files, specifically control task.php, control project.php, and default user.php, to filter the sort parameter, leading to a SQL injection...
PT-2021-17505
exploit 1. CVE-2021-27552: SQL injection vulnerability in /Final/edit user.php via the id parameter https://github.com/sapkota2k20/CVE-2021-27552 2. CVE-2021-27553: Incorrect access control vulnerability that may lead to LPE through /Final/normal/dashboard.php...
PT-2021-17504
exploit 1. CVE-2021-27552: SQL injection vulnerability in /Final/edit user.php via the id parameter https://github.com/sapkota2k20/CVE-2021-27552 2. CVE-2021-27553: Incorrect access control vulnerability that may lead to LPE through /Final/normal/dashboard.php...
PT-2021-4025
Name of the Vulnerable Software and Affected Versions SourceCodester Theme Park Ticketing System version 1.0 Description The issue allows remote attackers to execute arbitrary SQL statements via the id parameter to "view user.php". This is due to a lack of protection against SQL query structure...
PT-2020-11252
Name of the Vulnerable Software and Affected Versions NukeViet versions prior to 4.3.04 Description The issue arises from the deserialization of the untrusted nvloginhash cookie in the includes/core/is user.php file. This is problematic because the code relies on PHP's serialization format, which...
CVE-2020-22723
A cross-site scripting XSS vulnerability in Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop version 1.14 allows remote attackers to inject arbitrary web script or HTML via user.php by registering an account directly in the user center, and then adding the payload to the delivery address...
Cross site scripting
A cross-site scripting XSS vulnerability in Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop version 1.14 allows remote attackers to inject arbitrary web script or HTML via user.php by registering an account directly in the user center, and then adding the payload to the delivery address...
CVE-2020-22723
A cross-site scripting XSS vulnerability in Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop version 1.14 allows remote attackers to inject arbitrary web script or HTML via user.php by registering an account directly in the user center, and then adding the payload to the delivery address...
CVE-2020-22723: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in Beijing Liangjing Zhicheng Technology Co., Ltd ljcmsshop version 1.14 allows remote attackers to inject arbitrary web script or HTML via user.php by registering an account directly in the user center, and then adding the payload to the delivery address...
PT-2020-15501
Name of the Vulnerable Software and Affected Versions ljcmsshop version 1.14 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via user.php by registering an account directly in the user center and adding the payload to the delivery addres...
CVE-2020-25004
Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary code...
Sql injection
Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary code...
CVE-2020-25004
CVE-2020-25004 affects Heybbs v1.2. The vulnerability is a SQL injection in the user.php file via the ID parameter that may allow a remote attacker to execute arbitrary code. According to the connected documents, exploitation details are not provided in these sources, and CVSS metrics from NVD in...