PT-2021-16363

Name of the Vulnerable Software and Affected Versions: Check & Log Email WordPress plugin versions prior to 1.0.4 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the d parameter is not properly escaped before being outputted back in an attribute...

CVE-2021-24908: Improper Neutralization of Input During Web Page Generation

The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting...

CVE-2021-20115: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability exists in TCExam = 14.8.3. The paths provided in the f, d, and dir parameters in tcefilemanager.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link...

CVE-2021-20116: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability exists in TCExam = 14.8.4. The paths provided in the f, d, and dir parameters in tceselectmediafile.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious lin...

CVE-2014-5362: Improper Input Validation

The admin interface in Landesk Management Suite 9.6 and earlier allows remote attackers to conduct remote file inclusion attacks involving ASPX pages from third-party sites via the d parameter to 1 ldms/smactionfrm.asp or 2 remote/frmcoremainfrm.aspx; or the 3 top parameter to...

CVE-2014-6389: Improper Control of Generation of Code

backup.php in PHPCompta/NOALYSS before 6.7.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the d parameter...

CVE-2014-2219: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in whizzywig/wb.php in CMSimple Classic 3.54 and earlier, possibly as downloaded before February 26, 2014, allows remote attackers to inject arbitrary web script or HTML via the d parameter...

CVE-2013-3721

SQL injection vulnerability in awards.php in PsychoStats 3.2.2b allows remote attackers to execute arbitrary SQL commands via the d parameter...

CVE-2013-3721: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in awards.php in PsychoStats 3.2.2b allows remote attackers to execute arbitrary SQL commands via the d parameter...

CVE-2011-5041: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Pulse Pro CMS 1.7.2 allow remote attackers to inject arbitrary web script or HTML via the 1 d parameter in a blocks action and 2 postid parameter in an edit-post action to index.php...

CVE-2010-4735: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in shoppingcart.asp in Ecommercemax Solutions Digital-goods seller DGS 1.5 allows remote attackers to execute arbitrary SQL commands via the d parameter...

CVE-2008-3090: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in BlognPlus BURO GUN + 2.5.5 MySQL and PostgreSQL editions allow remote attackers to execute arbitrary SQL commands via the 1 p, 2 e, 3 d, and 4 m parameters, a different vulnerability than CVE-2008-2819...

CVE-2007-5776: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in igallery.asp in Blue-Collar Productions i-Gallery 3.4 allows remote attackers to read arbitrary files via encoded backslash sequences in the d parameter, as demonstrated by a "%5c../../%5c" sequence...

CVE-2007-5648: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in rnote.php in rNote 0.9.7.5 allow remote attackers to inject arbitrary web script or HTML via the 1 d or the 2 u parameter...

CVE-2003-1345: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in s.dll in WebCollection Plus 5.00 allows remote attackers to view arbitrary files in c:\ via a full pathname in the d parameter...

CVE-2007-2802: Undefined Security Weakness

Cross-site scripting XSS vulnerability in cp/ps/Main/login/Login in RM EasyMail Plus allows remote attackers to inject arbitrary web script or HTML via the d parameter...

CVE-2007-1773: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in aBitWhizzy allow remote attackers to list arbitrary directories via a .. dot dot in the d parameter to 1 whizzery/whizzypic.php or 2 whizzery/whizzylink.php, different vectors than CVE-2006-6384...

CVE-2007-1774: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in aBitWhizzy allow remote attackers to inject arbitrary web script or HTML via the d parameter to 1 whizzery/whizzypic.php or 2 whizzery/whizzylink.php...

CVE-2006-7062: Undefined Security Weakness

calendar.php in Kamgaing Email System kmail 2.3 and earlier allows remote attackers to obtain the full path of the server via an invalid d parameter, which leaks the path in an error message...

CVE-2006-6446: Undefined Security Weakness

SQL injection vulnerability in index.php in iWare Professional 5.0.4, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the D parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...