433 matches found
The vulnerability of the implementation of the DefaultActionMapper mechanism in the Apache Struts software platform allows a perpetrator to execute arbitrary code.
The vulnerability of the DefaultActionMapper mechanism implemented by the Apache Struts software platform is related to insufficient cleaning of input data when processing parameters such as action:, redirect:, and redirectAction: prefix. Exploiting this vulnerability allows an attacker to execut...
CVE-2022-40912
ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting XSS. Input passed to the GET parameter 'action' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser session in...
CVE-2022-40912: Improper Neutralization of Input During Web Page Generation
ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting XSS. Input passed to the GET parameter 'action' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser session in...
PT-2022-23864 · Cuppacms · Cuppacms
Name of the Vulnerable Software and Affected Versions: CuppaCMS version 1.0 Description: The issue allows an authenticated user to execute remote code, providing control over certain parameters. Specifically, the /api/index.php API endpoint is affected, where an attacker can manipulate the action...
PT-2022-24320 · Unknown · Interview Management System
Name of the Vulnerable Software and Affected Versions: Interview Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the /interview/delete.php component, specifically through the action and id parameters. Recommendations: For...
MantisBT XSS via adm_config_report.php's action parameter
A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2...
Cross-site Scripting (XSS)
Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the action parameter. An attacker can inject arbitrary web script or HTML by crafting a malicious action parameter value. Details Cross-site scripting or XSS is a...
GHSA-V7QF-22RW-CHPH MantisBT XSS via adm_config_report.php's action parameter
A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2...
CVE-2022-26267
Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenanceactions.php...
CVE-2022-26267
CVE-2022-26267 affects Piwigo v12.2.0, with an information leak via the action parameter in /admin/maintenance_actions.php. The available connected records consistently describe Piwigo 12.2.0 as vulnerable to information disclosure through this endpoint; no exploit details or affected versions be...
Piwigo 访问控制错误漏洞
Piwigo is a Web-based open source photo gallery software. The software includes features such as image management, image categorization and permission management. A security vulnerability exists in Piwigo version 12.2.0, which was discovered via an information leak in the action parameter in...
PT-2022-17753 · Piwigo · Piwigo
Name of the Vulnerable Software and Affected Versions: Piwigo version 12.2.0 Description: The issue is related to an information leak in Piwigo. This leak occurs via the action parameter in the "/admin/maintenance actions.php" API endpoint. Recommendations: For Piwigo version 12.2.0, as a tempora...
CVE-2022-26267: Missing Authentication for Critical Function
Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenanceactions.php...
CVE-2020-18327: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/admin/admin-nodebrowser API. Fixed in v6.2...
PT-2022-8593 · Alfresco · Alfresco Community Edition
Name of the Vulnerable Software and Affected Versions: Alfresco Community Edition versions 5.2.0 through 6.1 Description: A Cross Site Scripting XSS issue exists via the action parameter in the "alfresco/s/admin/admin-nodebrowser" API endpoint. This allows for potential exploitation. The issue is...
Authenticated-RCE-CuppaCMS
Authenticated-RCE-CuppaCMS CuppaCMS is vulnerable to Authentic...
CVE-2021-24973
The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsraction AJAX action available to unauthenticated and any authenticated users, allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard...
CVE-2021-43176
The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the...
CVE-2021-43176: Relative Path Traversal
The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the...