CVE-2019-3963

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patientid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3963: Improper Neutralization of Input During Web Page Generation

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patientid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3964: Improper Neutralization of Input During Web Page Generation

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the docid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3965: Improper Neutralization of Input During Web Page Generation

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the documentid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2019-3966: Improper Neutralization of Input During Web Page Generation

In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the foreignid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...

CVE-2018-18802: Cross-Site Request Forgery (CSRF)

The Tubigan "Welcome to our Resort" 1.0 software allows CSRF via admin/modusers/controller.php?action=edit...

CVE-2019-10647: Unrestricted Upload of File with Dangerous Type

ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source parameter because of a lack of inc/zzzfile.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if th...

Cross site request forgery (csrf)

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit...

CVE-2018-18799

School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos...

CVE-2018-18799: Cross-Site Request Forgery (CSRF)

School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos...

CVE-2018-18793: Unrestricted Upload of File with Dangerous Type

School Event Management System 1.0 allows Arbitrary File Upload via event/controller.php?action=photos...

CVE-2018-18794: Cross-Site Request Forgery (CSRF)

School Event Management System 1.0 allows CSRF via user/controller.php?action=edit...

Directory traversal

statics/ueditor/php/vendor/Local.class.php in YUNUCMS 1.1.5 allows arbitrary file deletion via the statics/ueditor/php/controller.php?action=remove key parameter, as demonstrated by using directory traversal to delete the install.lock file...

stockex.co.tt XSS vulnerability

Open Bug Bounty ID: OBB-605007 Description| Value ---|--- Affected Website:| stockex.co.tt Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Joomla! Zh YandexMap 6.2.1.0 SQL Injection

input name="id" value="-11 UNION ALL SELECT...

CVE-2018-6308: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injections exist in SugarCRM Community Edition 6.5.26 and below via the track parameter to modules\Campaigns\Tracker.php and modules\Campaigns\utils.php, the defaultcurrencyname parameter to modules\Configurator\controller.php and modules\Currencies\Currency.php, the duplicate...

CVE-2017-5487: Exposure of Sensitive Information to an Unauthorized Actor

wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listings of post authors, which allows remote attackers to obtain sensitive information via a wp-json/wp/v2/users request...

CVE-2015-7816: Undefined Security Weakness

The DisplayTopKeywords function in plugins/Referrers/Controller.php in Piwik before 2.15.0 allows remote attackers to conduct PHP object injection attacks, conduct Server-Side Request Forgery SSRF attacks, and execute arbitrary PHP code via a crafted HTTP header...

CVE-2015-1060: Undefined Security Weakness

Open redirect vulnerability in lib/Cake/Controller/Controller.php in AdaptCMS 3.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the HTTP Referer header...

ImpressPages CMS 3.6 - Arbitrary File Deletion

ImpressPages CMS 3.6 - Arbitrary File Deletion ImpressPages CMS v3.6 Remote Arbitrary File Deletion Vulnerability Vendor: ImpressPages UAB Product web page: http://www.impresspages.org Affected version: 3.6 Summary: ImpressPages CMS is an open source web content management system with...