CVE-2024-12894

CVE-2024-12894 affects TreasureHuntGame TreasureHunt up to commit 963e0e0, targeting the file TreasureHunt/acesso.php. The vulnerability arises from manipulating the input parameter usuario , enabling SQL injection . This can be exploited remotely, and the project uses a rolling release, with no ...

GHSA-2JCW-R79X-4R5V Moodle does not set the RISK_XSS bit for graders

access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted essay feedback...

job-mo.ru XSS vulnerability

Open Bug Bounty ID: OBB-269832 Description| Value ---|--- Affected Website:| job-mo.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

cinra.co.jp XSS vulnerability

Vulnerable URL: https://www.cinra.co.jp/creative/mailmag/access.php?redirect=http://xssposed.org"'--!confirmOPENBUGBOUNTY...

concrete5 'Access.php' SQL Injection Vulnerability

concrete5 is a free content management system CMS developed by Portland Labs in the United States. The system allows editing and layout directly on the page. A SQL injection vulnerability exists in concrete5 that stems from the program failing to adequately filter user-submitted input before...

[KIS-2015-03] Concrete5 <= 5.7.4 (Access.php) SQL Injection Vulnerability

----------------------------------------------------------- Concrete5 = 5.7.4 Access.php SQL Injection Vulnerability ----------------------------------------------------------- - Software Link: https://www.concrete5.org/ - Affected Versions: Version 5.7.3.1, 5.7.4, and probably other versions. -...

Concrete5 5.7.4 SQL Injection

----------------------------------------------------------- Concrete5 0 173. foreach $filterEntities as $ent 174. $filters = $ent-getAccessEntityID; 175. 176. $peIDs .= 'and peID in ' . implode$filters, ',' . ''; 177. 178. if $accessType == 0 179. $accessType = ''; 180. else 181. $accessType = '...

Concrete5 5.7.4 SQL Injection Vulnerability

Concrete5 versions 5.7.4 and below suffer from a remote SQL injection vulnerability. ----------------------------------------------------------- Concrete5 0 173. foreach $filterEntities as $ent 174. $filters = $ent-getAccessEntityID; 175. 176. $peIDs .= 'and peID in ' . implode$filters, ',' . '';...

CVE-2015-0216

access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted essay feedback...

CVE-2015-0216

access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted essay feedback...

CVE-2015-0216

access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted essay feedback...

CVE-2015-3174

mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted gradebook feedback during manual quiz grading...

CVE-2015-0216

access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted essay feedback...

CVE-2015-3174

mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted gradebook feedback during manual quiz grading...

PT-2015-1608

Name of the Vulnerable Software and Affected Versions Moodle versions 2.8.x through 2.8.1 Description The issue allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted essay feedback. This is due to the failure to set the RISK XSS bit for graders in the access.ph...

CVE-2015-0216: Improper Neutralization of Input During Web Page Generation

access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted essay feedback...

CVE-2015-3174: Improper Neutralization of Input During Web Page Generation

mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted gradebook feedback during manual quiz grading...

PT-2015-1573

Name of the Vulnerable Software and Affected Versions Moodle versions 2.5.9 and earlier, 2.6.x before 2.6.11, 2.7.x before 2.7.8, 2.8.x before 2.8.6 Description The issue allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted gradebook feedback during manual qui...

MetInfo 5.1 /message/access.php $id SQL注入漏洞

No description provided by source...

CVE-2012-6563

engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during plugin boot, which allows remote attackers to read private entities via unspecified vectors...