Cross-Site Request Forgery (CSRF)

microweber/microweber is vulnerable to cross-site request forgeryCSRF. The vulnerability exists due to a lack of input sanitization in the api.php file allowing the attacker to manipulate authorized users to initiate unwanted actions...

CVE-2021-43679

ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php...

CVE-2021-43679

ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php...

Sql injection

ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php...

Cross site scripting

nZEDb v0.4.20 is affected by a Cross Site Scripting XSS vulnerability in www/pages/api.php. The exit function will terminate the script and print the message which has the input $GET't'...

CVE-2021-43686

nZEDb v0.4.20 is affected by a Cross Site Scripting XSS vulnerability in www/pages/api.php. The exit function will terminate the script and print the message which has the input $GET't'...

CVE-2021-43686

nZEDb v0.4.20 is affected by a Cross Site Scripting XSS vulnerability in www/pages/api.php. The exit function will terminate the script and print the message which has the input $GET't'...

CVE-2021-43679: Improper Neutralization of Special Elements used in an SQL Command

ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php...

CVE-2021-43686: Improper Neutralization of Input During Web Page Generation

nZEDb v0.4.20 is affected by a Cross Site Scripting XSS vulnerability in www/pages/api.php. The exit function will terminate the script and print the message which has the input $GET't'...

PT-2021-23912

Name of the Vulnerable Software and Affected Versions: nZEDb version 0.4.20 Description: The issue is related to a Cross Site Scripting XSS vulnerability in the www/pages/api.php file. The exit function terminates the script and prints a message that includes the input from $ GET't'. This allows...

PT-2021-23907

Name of the Vulnerable Software and Affected Versions: ecshop version 2.7.3 Description: The issue is a SQL injection vulnerability located in the shopexecshopuploadapiclientapi.php file. This vulnerability can be exploited through the API endpoint /api/client/api.php, although the specific...

in hascheksolutions/opentrashmail

✍️ Description Attackers can control the filesystem path argument to readfile at api.php line 35 for ?email= parameter, which allows them to access or modify otherwise protected files. Analysis Trace: 1. application take unsensitized input at: $email = strtolower$REQUEST'email'; 2. Assigning user...

CVE-2020-21998

In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted o...

Design/Logic Flaw

In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted o...

CVE-2020-21998: URL Redirection to Untrusted Site

In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted o...

PT-2021-10713

Name of the Vulnerable Software and Affected Versions HomeAutomation version 3.3.2 Description The issue arises from improper verification of input passed via the redirect GET parameter in the "api.php" script. This can be exploited to redirect a user to an arbitrary website, for example, when a...

CVE-2020-6577: Improper Neutralization of Special Elements used in an SQL Command

The IT-Recht Kanzlei plugin in Zen Cart 1.5.6c German edition allows itrk-api.php rechtstextlanguage SQL Injection...

PT-2021-12495

Name of the Vulnerable Software and Affected Versions: Zen Cart version 1.5.6c Description: The issue concerns a SQL Injection vulnerability in the IT-Recht Kanzlei plugin. Specifically, the itrk-api.php endpoint is affected, allowing SQL Injection through the rechtstext language parameter...

CVE-2020-16629

PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data through SQL, and then call the attachment replacement function through api.php to write a PHP file to the target path...

Sql injection

PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data through SQL, and then call the attachment replacement function through api.php to write a PHP file to the target path...