CVE-2021-27320

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter...

PT-2021-17396

Name of the Vulnerable Software and Affected Versions Doctor Appointment System version 1.0 Description The issue is related to a blind SQL injection in the contactus.php file, allowing an unauthenticated attacker to insert malicious SQL queries via the firstname parameter. Recommendations For...

CVE-2021-27320: Improper Neutralization of Special Elements used in an SQL Command

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter...

Doctor Appointment System 1.0 Blind SQL Injection Vulnerability

Exploit Title: Doctor Appointment System 1.0 Blind SQL injection in email parameter CVE: CVE-2021-27319 Exploit Author: Nakul Ratti Vendor Homepage: https://www.sourcecodester.com/php/14182/doctor-appointment-system.html Software Link:...

Mail.ru: Stored XSS на странице "Почты" [city-mobil.ru/taxiserv]

Stored XSS on city-mobil.ru/taxiserv mail page via firstname and lastname of driver...

Mail.ru: Stored XSS на странице "Изменить клиента", вкладка "История" [city-mobil.ru/taxiserv]

Stored XSS on city-mobil.ru/taxiserv driver page via firstname and lastname of driver...

PT-2020-14523

Name of the Vulnerable Software and Affected Versions Victor CMS through 2019-02-28 Description The issue allows for XSS attacks via the register.php user firstname or user lastname field. Recommendations For Victor CMS through 2019-02-28, consider disabling the register.php page or restricting...

PT-2020-14079 · Global Radar · Global Radar Bsa Radar

Name of the Vulnerable Software and Affected Versions: Global RADAR BSA Radar versions 1.6.7234.24750 and earlier Description: The issue concerns stored cross-site scripting XSS via the Update User Profile feature. Specifically, the Firstname and Lastname parameters are vulnerable. Recommendation...

PT-2020-13534

Name of the Vulnerable Software and Affected Versions Victor CMS version 1.0 Description The issue is related to Persistent XSS in the "admin/users.php?source=add user" endpoint via the user name, user firstname, or user lastname parameters. Recommendations For Victor CMS version 1.0, as a...

CVE-2020-14943: Improper Neutralization of Input During Web Page Generation

The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting XSS via Update User Profile...

Mail.ru: HTTP-Response-Splitting leads to information disclosure (email, firstname, lastname) at https://tz.mail.ru

CRLF injection via GET paramaters in tz.mail.ru Clientside vulnerabilities in tz.mail.ru is not currently covered by Bug Bounty program...

osTicket 1.12 Cross Site Scripting

Exploit Title: osTicket-v1.12 Stored XSS Vendor Homepage: https://osticket.com/ Software Link: https://osticket.com/download/ Exploit Author: Aishwarya Iyer Contact: https://twitter.com/aish9524 Website: https://about.me/aishiyer Category: webapps CVE: CVE-2019-14750 1. Description An issue was...

CVE-2019-14750

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...

PT-2019-5952

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.10.7 osTicket versions 1.12.x prior to 1.12.1 Description The issue is related to a lack of input sanitization in the firstname and lastname fields, allowing for stored XSS attacks. This can lead to the execution o...

CVE-2019-14750: Improper Neutralization of Input During Web Page Generation

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...

CVE-2019-14331

An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create User. A malicious attacker can modify the firstName and lastName to contain JavaScript code...

CVE-2019-14330

An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicious attacker can modify the firstName and lastName to contain JavaScript code...

PT-2019-13612

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 5.6.6 Description A stored XSS issue exists due to the lack of filtration of user-supplied data in Create Case. An attacker can modify the firstName and lastName to contain JavaScript code. Recommendations For version...

PT-2019-13613

Name of the Vulnerable Software and Affected Versions EspoCRM versions prior to 5.6.6 Description An issue exists due to the lack of filtration of user-supplied data in the Create User function, allowing stored XSS. A malicious attacker can modify the firstName and lastName fields to contain...

CVE-2019-14331: Improper Neutralization of Input During Web Page Generation

An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create User. A malicious attacker can modify the firstName and lastName to contain JavaScript code...