CVE-2021-24424

The WP Reset – Most Advanced WordPress Reset Tool WordPress plugin before 1.90 did not sanitise or escape its extradata parameter when creating a snapshot via the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue...

PT-2021-15954

Name of the Vulnerable Software and Affected Versions The WP Reset – Most Advanced WordPress Reset Tool version prior to 1.90 Description The issue is related to an authenticated Stored Cross-Site Scripting problem. This occurs because the extra data parameter is not properly sanitised or escaped...

CVE-2020-24148: Server-Side Request Forgery (SSRF)

Server-side request forgery SSRF in the Import XML and RSS Feeds import-xml-feed plugin 2.0.1 for WordPress via the data parameter in a moovereadxml action...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Jannah WordPress theme versions prior to...

PT-2021-11019

Name of the Vulnerable Software and Affected Versions: Import XML and RSS Feeds plugin version 2.0.1 Description: The issue is related to server-side request forgery SSRF in the Import XML and RSS Feeds plugin for WordPress. This occurs via the data parameter in a moove read xml action...

PT-2021-2332

Name of the Vulnerable Software and Affected Versions IBM QRadar SIEM versions 7.3.0 through 7.3.3 Patch 5 IBM QRadar SIEM versions 7.4.0 through 7.4.1 Patch 1 IBM QRadar SIEM versions 7.4.2 GA through 7.4.2 Patch 1 Description The issue is related to insufficient server-side request validation i...

CVE-2020-23522

Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data Password parameter...

CVE-2020-35748

Cross-site scripting XSS vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the fvwpfvvideoplayersrc JSON field in the data parameter...

WordPress FV Flowplayer Video Player 跨站脚本漏洞

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.FV Flowplayer Video Player is a video player plugin used in it. relevant is a relevant content display plugin used in it. A cross-site...

Online Marriage Registration System SQL Injection Vulnerability

Online Marriage Registration System is a website builder that supports online marriage registration. A SQL injection vulnerability exists in Online Marriage Registration System version 1.0, which stems from a lack of validation of the searchdata parameter of the search.php request against an...

Phpgurukul Online Marriage Registration System SQL注入漏洞

Online Marriage Registration System is a website builder that supports online marriage registration. A SQL injection vulnerability exists in Online Marriage Registration System version 1.0, which stems from a lack of validation of the searchdata parameter of the search.php request against an...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection a malicious user could inject commands through the data variable: Affected Area require'../server/getJsonByCurl'mock2easy, function error, stdout if error return res.json500, error; res.jsonJSON.parsestdout; , '',...

PT-2020-12130

Name of the Vulnerable Software and Affected Versions Chadha PHPKB Standard Multi-Language version 9 Description The issue allows attackers to inject untrusted input inside CSV files via the data parameter in the admin/include/operations.php file, which is accessible through...

UBUNTU-CVE-2018-18836

An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of webclientapirequestv1data in web/api/webapiv1.c...

Webmin Arbitrary Command Execution Vulnerability

Webmin is a set of Web-based system management tools for Unix-like operating systems. A security vulnerability exists in Webmin versions 1.910 and earlier. The vulnerability can be exploited to execute arbitrary commands with root privileges by sending the 'data' parameter to the update.cgi file...

CVE-2019-12840

In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi...

PT-2019-18683

Name of the Vulnerable Software and Affected Versions TheHive Project UnshortenLink analyzer versions prior to 1.1 Cortex-Analyzers versions prior to 1.15.2 Description The issue allows for Server-Side Request Forgery SSRF attacks. An attacker can exploit this by creating a new analysis, selectin...

CVE-2019-7652: Server-Side Request Forgery (SSRF)

TheHive Project UnshortenLink analyzer before 1.1, included in Cortex-Analyzers before 1.15.2, has SSRF. To exploit the vulnerability, an attacker must create a new analysis, select URL for Data Type, and provide an SSRF payload like "http://127.0.0.1:22" in the Data parameter. The result can be...

CVE-2019-10867

An issue was discovered in Pimcore before 5.7.1. An attacker with classes permission can send a POST request to /admin/class/bulk-commit, which will make it possible to exploit the unserialize function when passing untrusted values in the data parameter to...

PT-2019-12064

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 5.7.1 Description An issue allows an attacker with classes permission to exploit the unserialize function by sending a POST request to "/admin/class/bulk-commit" and passing untrusted values in the data parameter to...