662 matches found
PT-2020-15883
Name of the Vulnerable Software and Affected Versions Heybbs version 1.2 Description The issue is related to a SQL injection vulnerability in the user.php file, specifically via the ID parameter. This may allow a remote attacker to execute arbitrary code. Recommendations For Heybbs version 1.2,...
CVE-2020-25004: Improper Neutralization of Special Elements used in an SQL Command
Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary code...
PT-2020-15594
Name of the Vulnerable Software and Affected Versions OSWAPP Warehouse Inventory System aka OSWA-INV versions prior to 2020-08-10 Description A Cross-Site Request Forgery CSRF issue allows remote attackers to change the admin's password after an authenticated admin visits a third-party site. This...
CVE-2020-15721
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php...
CVE-2020-15721
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php...
Design/Logic Flaw
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php...
CVE-2020-15721
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php...
CVE-2020-15721
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php...
CVE-2020-15721
CVE-2020-15721 affects RosarioSIS up to 6.8-beta. A cross-site scripting (XSS) issue is caused by the href attributes in modules/Custom/NotifyParents.php affecting AddStudents.php and User.php. The connected documents do not provide a patch version, workaround, or explicit exploitation details. N...
CVE-2020-15721: Improper Neutralization of Input During Web Page Generation
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php...
PT-2020-13361
Name of the Vulnerable Software and Affected Versions NukeViet version 4.4 Description The issue allows for Cross-Site Request Forgery CSRF attacks, enabling an attacker to add a user account via the "admin/index.php?nv=users&op=user add" URI. This is possible due to a vulnerability in the...
CVE-2020-13827
phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php...
Design/Logic Flaw
phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php...
CVE-2020-13827
phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php...
CVE-2020-13827: Improper Neutralization of Input During Web Page Generation
phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php...
CVE-2020-10410
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/edit-user.php by adding a question mark ? followed by the payload...
Cross site scripting
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/report-user.php by adding a question mark ? followed by the payload...
Cross site scripting
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/add-user.php by adding a question mark ? followed by the payload...
CVE-2020-10451
CVE-2020-10451 affects Chadha PHPKB Standard Multi‑Language 9. The issue is in URI handling in admin/header.php, enabling Reflected XSS in admin/report-user.php when a ? payload is appended; documentation also notes similar URI handling XSS patterns in related Red Hat advisories (e.g., add-articl...
CVE-2020-10410
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/edit-user.php by adding a question mark ? followed by the payload...