78 matches found
CVE-2022-1609
The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site...
CVE-2025-2356
A vulnerability was found in BlackVue App 3.65 on Android. It has been classified as problematic. This affects the function deviceDelete of the component API Handler. The manipulation leads to use of get request method with sensitive query strings. It is possible to initiate the attack remotely...
CVE-2025-2335
A vulnerability classified as problematic was found in Drivin Soluções up to 20250226. This vulnerability affects unknown code of the file /api/school/registerSchool of the component API Handler. The manipulation of the argument message leads to cross site scripting. The attack can be initiated...
CVE-2025-2356
A vulnerability was found in BlackVue App 3.65 on Android. It has been classified as problematic. This affects the function deviceDelete of the component API Handler. The manipulation leads to use of get request method with sensitive query strings. It is possible to initiate the attack remotely...
CVE-2025-2356 BlackVue App API deviceDelete get request method with sensitive query strings
A vulnerability was found in BlackVue App 3.65 on Android. It has been classified as problematic. This affects the function deviceDelete of the component API Handler. The manipulation leads to use of get request method with sensitive query strings. It is possible to initiate the attack remotely...
PT-2025-11450
Name of the Vulnerable Software and Affected Versions BlackVue App version 3.65 Description A vulnerability was found in the BlackVue App, affecting the function deviceDelete of the component API Handler. The manipulation leads to the use of the GET request method with sensitive query strings. It...
CVE-2025-2356: Use of GET Request Method With Sensitive Query Strings
A vulnerability was found in BlackVue App 3.65 on Android. It has been classified as problematic. This affects the function deviceDelete of the component API Handler. The manipulation leads to use of get request method with sensitive query strings. It is possible to initiate the attack remotely...
CVE-2025-2335
A vulnerability classified as problematic was found in Drivin Soluções up to 20250226. This vulnerability affects unknown code of the file /api/school/registerSchool of the component API Handler. The manipulation of the argument message leads to cross site scripting. The attack can be initiated...
CVE-2025-2335
CVE-2025-2335 affects Drivin Soluções up to 20250226. The vulnerability is an XSS in the API Handler’s /api/school/registerSchool, caused by manipulation of the message argument. It can be exploited remotely and the exploit has been disclosed publicly. Affected component is the API Handler; root ...
CVE-2025-2335 Drivin Soluções API registerSchool cross site scripting
A vulnerability classified as problematic was found in Drivin Soluções up to 20250226. This vulnerability affects unknown code of the file /api/school/registerSchool of the component API Handler. The manipulation of the argument message leads to cross site scripting. The attack can be initiated...
PT-2025-11375
Name of the Vulnerable Software and Affected Versions Drivin Soluções up to 20250226 Description A vulnerability was found in Drivin Soluções, affecting the /api/school/registerSchool API endpoint of the API Handler component. The manipulation of the message argument leads to cross-site scripting...
CVE-2025-2335: Improper Neutralization of Input During Web Page Generation
A vulnerability classified as problematic was found in Drivin Soluções up to 20250226. This vulnerability affects unknown code of the file /api/school/registerSchool of the component API Handler. The manipulation of the argument message leads to cross site scripting. The attack can be initiated...
CVE-2025-2124
A vulnerability, which was classified as problematic, was found in Control iD RH iD 25.2.25.0. This affects an unknown part of the file /v2/customerdb/person.svc/changepassword of the component API Handler. The manipulation of the argument message leads to cross site scripting. It is possible to...
CVE-2025-2124
A vulnerability, which was classified as problematic, was found in Control iD RH iD 25.2.25.0. This affects an unknown part of the file /v2/customerdb/person.svc/changepassword of the component API Handler. The manipulation of the argument message leads to cross site scripting. It is possible to...
CVE-2025-2124 Control iD RH iD API change_password cross site scripting
A vulnerability, which was classified as problematic, was found in Control iD RH iD 25.2.25.0. This affects an unknown part of the file /v2/customerdb/person.svc/changepassword of the component API Handler. The manipulation of the argument message leads to cross site scripting. It is possible to...
CVE-2025-2124
CVE-2025-2124 affects Control iD RH iD 25.2.25.0. The issue resides in the API handler, specifically the file path /v2/customerdb/person.svc/change_password, where manipulation of the argument message leads to cross-site scripting. It can be initiated remotely and the exploit has been disclosed p...
PT-2025-10452
Name of the Vulnerable Software and Affected Versions Control iD RH iD version 25.2.25.0 Description A vulnerability was found in the API Handler component of Control iD RH iD, affecting an unknown part of the file /v2/customerdb/person.svc/change password. The manipulation of the message argumen...
CVE-2025-2124: Improper Neutralization of Input During Web Page Generation
A vulnerability, which was classified as problematic, was found in Control iD RH iD 25.2.25.0. This affects an unknown part of the file /v2/customerdb/person.svc/changepassword of the component API Handler. The manipulation of the argument message leads to cross site scripting. It is possible to...
CVE-2024-6893
The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources...
CVE-2024-6893
The "soapcgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhelm the web server resources...