CVE-2021-20116: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability exists in TCExam = 14.8.4. The paths provided in the f, d, and dir parameters in tceselectmediafile.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious lin...

CVE-2021-20115: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability exists in TCExam = 14.8.3. The paths provided in the f, d, and dir parameters in tcefilemanager.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link...

PT-2021-10304

Name of the Vulnerable Software and Affected Versions: PHPOK version 5.2.060 Description: A Cross Site Request Forgery CSRF issue exists, which could allow a remote malicious user to execute arbitrary code via the "admin.php?c=admin&f=save" API endpoint, specifically through the c and f parameter...

VulnCheck KEV: CVE-2005-2847

img.pl in Barracuda Spam Firewall running firmware 3.1.16 and 3.1.17 allows remote attackers to execute arbitrary commands via shell metacharacters in the f parameter...

PT-2019-15908

Name of the Vulnerable Software and Affected Versions nopCommerce version 4.2.0 Description The issue concerns a path traversal vulnerability via ../ in the d or f parameters to "Admin/RoxyFileman/ProcessRequest" due to a flaw in "Libraries/Nop.Services/Media/RoxyFileman/FileRoxyFilemanService.cs...

CVE-2019-16986

In FusionPBX up to v4.5.7, the file resources\download.php uses an unsanitized "f" variable coming from the URL, which takes any pathname and allows a download of it. resources\securedownload.php is also affected...

S-CMS e-commerce system aj***.php page L_f*** parameter has SQL injection vulnerability

S-CMS e-commerce system is an e-commerce software. S-CMS e-commerce system aj.php page Lf parameter exists SQL injection vulnerability, an attacker can use the vulnerability to obtain database sensitive information...

DedeCMS Cross-Site Scripting Vulnerability (CNVD-2019-01728)

DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the /member/uploadsselect.php file in DedeCMS version 5.7 SP2, which can be exploited by a remote attacker with the help of the 'f' or 'keyword' parameter to A remote attacker can use the 'f' ...

CVE-2018-17832

XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter...

CVE-2018-17832

WUZHICMS 2.0 is affected by a Cross-Site Scripting (XSS) vulnerability in index.php, exploitable via the v and f GET parameters. The issue is described as XSS in the WUZHICMS 2.0 web application, with PoC references showing injected content via index.php?v= and index.php?f=. No explicit root-caus...

CVE-2018-17832: Improper Neutralization of Input During Web Page Generation

XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter...

PT-2018-14212

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 2.0 Description A security issue exists due to the presence of XSS in the software. The issue is related to the v or f parameter in the "index.php" endpoint. Recommendations For WUZHI CMS version 2.0, consider restricting...

CVE-2018-13123

onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to read arbitrary files via the i and f parameters, as demonstrated by ?i=etc/&f=passwd&p=rawview for the /etc/passwd file...

PT-2018-11615

Name of the Vulnerable Software and Affected Versions OneFileCMS versions prior to 2017-10-08 Description The issue allows attackers to read arbitrary files via the i and f parameters. For example, the "/etc/passwd" file can be accessed using the endpoint "?i=etc/&f=passwd&p=raw view"...

CVE-2018-13123: Exposure of Sensitive Information to an Unauthorized Actor

onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to read arbitrary files via the i and f parameters, as demonstrated by ?i=etc/&f=passwd&p=rawview for the /etc/passwd file...

CVE-2018-12054: Improper Limitation of a Pathname to a Restricted Directory

Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal...

CVE-2018-12042: Improper Limitation of a Pathname to a Restricted Directory

Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter...

PT-2018-10964

Name of the Vulnerable Software and Affected Versions Roxy Fileman versions prior to 1.4.6 Description The issue allows for directory traversal via the "f" parameter in the php/download.php endpoint. Recommendations For Roxy Fileman versions prior to 1.4.6, update to version 1.4.6 or later to...

PT-2017-14038

Name of the Vulnerable Software and Affected Versions E-Sic version 1.0 Description A SQL Injection issue exists via the f parameter to the "esiclivre/restrito/inc/buscacep.php" script, which is used for zip code search. Recommendations For E-Sic version 1.0, consider restricting access to the...

CVE-2017-15381: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in E-Sic 1.0 via the f parameter to esiclivre/restrito/inc/buscacep.php aka the zip code search script...