88 matches found
CVE-2025-8621
The Mosaic Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘c’ parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...
CVE-2025-8621 Mosaic Generator <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'c' Parameter
The Mosaic Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘c’ parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...
CVE-2025-8621: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The Mosaic Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘c’ parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...
CVE-2021-35458
Online Pet Shop We App 1.0 is vulnerable to Union SQL Injection in products.php aka p=products via the c or s parameter...
WeGIA 跨站脚本漏洞
WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. WeGIA has a cross-site scripting vulnerability that stems from a reflected cross-site scripting vulnerability contained in the msgc parameter of the editarpermissoes.php file...
PT-2025-4587 · Wegia · Wegia
Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.8 Description: A Reflected Cross-Site Scripting XSS issue was identified in the "home.php" endpoint of the WeGIA application. This issue allows attackers to inject malicious scripts in the msg c parameter...
CVE-2025-22139 WeGIA Cross-Site Scripting (XSS) Reflected endpoint `configuracao_geral.php` parameter `msg`
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the configuracaogeral.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msgc parameter. This vulnerability is fixed ...
PT-2023-32075 · Unknown · Sourcecodester Online Computer/Laptop Store
Name of the Vulnerable Software and Affected Versions: SourceCodester Online Computer and Laptop Store version 1.0 Description: A critical vulnerability was found in the SourceCodester Online Computer and Laptop Store. The issue affects an unknown functionality of the file products.php. The...
CVE-2022-39195: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML via the c parameter...
PT-2023-7918 · L Soft · Listserv 17
Name of the Vulnerable Software and Affected Versions: LISTSERV 17 web interface Description: A cross-site scripting XSS issue in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML via the c parameter. This can be exploited by a remote attacker to conduct...
CVE-2021-24393: Improper Neutralization of Special Elements used in an SQL Command
A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...
CVE-2021-39599
Multiple Cross Site Scripting XSS vulnerabilities exists in CXUUCMS 3.1 in the search and c parameters in 1 public/search.php and in the 2 c parameter in admin.php...
CVE-2021-35458
Online Pet Shop We App 1.0 is vulnerable to Union SQL Injection in products.php aka p=products via the c or s parameter...
Sql injection
Online Pet Shop We App 1.0 is vulnerable to Union SQL Injection in products.php aka p=products via the c or s parameter...
CVE-2021-35458: Improper Neutralization of Special Elements used in an SQL Command
Online Pet Shop We App 1.0 is vulnerable to Union SQL Injection in products.php aka p=products via the c or s parameter...
PT-2023-11537 · Mpv +1 · Mpv +1
Name of the Vulnerable Software and Affected Versions: MPV version 0.29.1 Description: The issue allows attackers to execute arbitrary code and crash the program via the ao c parameter. Recommendations: For MPV version 0.29.1, update to version 0.30 to resolve the issue. As a temporary workaround...
CVE-2020-8823: Improper Neutralization of Input During Web Page Generation
htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c aka callback parameter...
CVE-2019-19387: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in app/fifolist/fifointeractive.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the c parameter...