Design/Logic Flaw

Verydows 2.0 has XSS via the index.php?c=main a parameter, as demonstrated by an a=indexXSS value...

FreshRSS Cross-Site Scripting Vulnerability

FreshRSS is an open source, self-hosted RSS aggregator with support. A cross-site scripting vulnerability exists in FreshRSS version 1.11.1. A remote attacker can exploit the vulnerability to inject arbitrary web script or HTML with the help of 'c' or 'a' parameter...

CVE-2018-19782: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in GET requests in FreshRSS 1.11.1 allow remote attackers to inject arbitrary web script or HTML via the 1 c parameter or 2 a parameter...

YzmCMS Cross-Site Scripting Vulnerability

YzmCMS is an open source CMS Content Management System developed by Chinese programmer Yuan Zhimeng. A cross-site scripting vulnerability exists in YzmCMS. A remote attacker can exploit this vulnerability to inject arbitrary Web script or HTML with the help of 'a', 'c' or 'm' parameters...

CVE-2018-7653: Improper Neutralization of Input During Web Page Generation

In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter...

CVE-2017-9276: Improper Neutralization of Input During Web Page Generation

Novell Access Manager iManager before 4.3.3 did not validate parameters so that cross site scripting content could be reflected back into the result page using the "a" parameter...

CVE-2014-5451: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/. NOTE: this issue exists because of a CVE-2014-2080 regression...

CVE-2014-3512

Multiple buffer overflows in crypto/srp/srplib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service application crash or possibly have unspecified other impact via an invalid SRP 1 g, 2 A, or 3 B parameter...

UBUNTU-CVE-2014-3512

Multiple buffer overflows in crypto/srp/srplib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service application crash or possibly have unspecified other impact via an invalid SRP 1 g, 2 A, or 3 B parameter...

CVE-2014-2080

Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter...

CVE-2014-2080: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in manager/templates/default/header.tpl in ModX Revolution before 2.2.11 allows remote attackers to inject arbitrary web script or HTML via the "a" parameter...

CVE-2012-4982: Improper Input Validation

Open redirect vulnerability in assets/login on the Forescout CounterACT NAC device before 7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the a parameter...

CVE-2010-4906: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in zp-core/full-image.php in Zenphoto 1.3 and 1.3.1.2 allows remote attackers to execute arbitrary SQL commands via the a parameter. NOTE: some of these details are obtained from third party information...

CVE-2009-2931: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in p.php in SlideShowPro Director 1.1 through 1.3.8 allows remote attackers to read arbitrary files via directory traversal sequences in the a parameter...

CVE-2008-1877: Undefined Security Weakness

tss 0.8.1 allows local users to read arbitrary files via the -a parameter, which is processed while tss is running with privileges...

CVE-2008-0280: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in MTCMS 2.0 and possibly earlier versions allows remote attackers to execute arbitrary SQL commands via the 1 a or 2 cid parameter...

CVE-2007-2416: Undefined Security Weakness

SQL injection vulnerability in home.php in E-Annu allows remote attackers to execute arbitrary SQL commands via the a parameter...

CVE-2006-5987: Undefined Security Weakness

SQL injection vulnerability in default.asp in ASPintranet, possibly 1.2, allows remote attackers to execute arbitrary SQL commands via the a parameter...

CVE-2006-3929: Undefined Security Weakness

Cross-site scripting XSS vulnerability in the Forms/rpSysAdmin script on the Zyxel Prestige 660H-61 ADSL Router running firmware 3.40PT.0b32 allows remote attackers to inject arbitrary web script or HTML via hex-encoded values in the a parameter...

CVE-2005-4047: Undefined Security Weakness

Cross-site scripting XSS vulnerability in kb.asp in IISWorks ASPKnowledgeBase 2.0 allows remote attackers to inject arbitrary web script or HTML via the a parameter...