CVE-2022-40912

ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting XSS. Input passed to the GET parameter 'action' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser session in...

PT-2022-23864 · Cuppacms · Cuppacms

Name of the Vulnerable Software and Affected Versions: CuppaCMS version 1.0 Description: The issue allows an authenticated user to execute remote code, providing control over certain parameters. Specifically, the /api/index.php API endpoint is affected, where an attacker can manipulate the action...

PT-2022-24320 · Unknown · Interview Management System

Name of the Vulnerable Software and Affected Versions: Interview Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the /interview/delete.php component, specifically through the action and id parameters. Recommendations: For...

Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the action parameter. An attacker can inject arbitrary web script or HTML by crafting a malicious action parameter value. Details Cross-site scripting or XSS is a...

GHSA-V7QF-22RW-CHPH MantisBT XSS via adm_config_report.php's action parameter

A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2...

MantisBT XSS via adm_config_report.php's action parameter

A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2...

CVE-2022-26267

Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenanceactions.php...

CVE-2022-26267

CVE-2022-26267 affects Piwigo v12.2.0, with an information leak via the action parameter in /admin/maintenance_actions.php. The available connected records consistently describe Piwigo 12.2.0 as vulnerable to information disclosure through this endpoint; no exploit details or affected versions be...

Piwigo 访问控制错误漏洞

Piwigo is a Web-based open source photo gallery software. The software includes features such as image management, image categorization and permission management. A security vulnerability exists in Piwigo version 12.2.0, which was discovered via an information leak in the action parameter in...

PT-2022-17753 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: Piwigo version 12.2.0 Description: The issue is related to an information leak in Piwigo. This leak occurs via the action parameter in the "/admin/maintenance actions.php" API endpoint. Recommendations: For Piwigo version 12.2.0, as a tempora...

PT-2022-8593 · Alfresco · Alfresco Community Edition

Name of the Vulnerable Software and Affected Versions: Alfresco Community Edition versions 5.2.0 through 6.1 Description: A Cross Site Scripting XSS issue exists via the action parameter in the "alfresco/s/admin/admin-nodebrowser" API endpoint. This allows for potential exploitation. The issue is...

Authenticated-RCE-CuppaCMS

Authenticated-RCE-CuppaCMS CuppaCMS is vulnerable to Authentic...

CVE-2021-24973

The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsraction AJAX action available to unauthenticated and any authenticated users, allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard...

CVE-2021-43176

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the...

CVE-2021-35059

OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way4acs/enroll action parameter...

Geutebruck instantrec Remote Command Execution Exploit

This Metasploit module exploits a buffer overflow within the 'action' parameter of the /uapi-cgi/instantrec.cgi page of Geutebruck G-Cam EEC-2xxx and G-Code EBC-21xx, EFD-22xx, ETHC-22xx, and EWPC-22xx devices running firmware versions equal to 1.12.0.27 as well as firmware versions 1.12.13.2 and...

CVE-2021-33549

Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the action parameter, which may allow an attacker to remotely execute arbitrary code...

CVE-2021-24438

The ShareThis Dashboard for Google Analytics WordPress plugin before 2.5.2 does not sanitise or escape the 'gaaction' parameter in the stats view before outputting it back in an attribute when the plugin is connected to a Google Analytics account, leading to a reflected Cross-Site Scripting issue...

多款 Geutebrück 摄像头设备缓冲区错误漏洞

Geutebrück G-Code EEC-2xxx and others are products of Geutebrück Germany.Geutebrück G-Code EEC-2xxx is an analog video encoder module.Geutebrück G-Cam EBC-21xx is an EBC-21xx series network camera. Geutebrück G-Cam EFD-22xx is an EFD-22xx series network camera. geutebrück G-Cam E2 and others are...

CVE-2020-13562

A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnaerability in the phpGACL template action parameter...