CVE-2020-10462

Reflected XSS in admin/edit-field.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p...

CVE-2020-10387

Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files from the server using a dot-dot-slash sequence ../ via the GET parameter file...

PT-2020-12132 · Chadha · Chadha Phpkb Standard Multi-Language

Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue allows attackers to inject arbitrary web script or HTML via the GET parameter p in the admin/edit-field.php file. This enables attackers to perform a Reflected XSS attack...

CVE-2020-10477: Improper Neutralization of Input During Web Page Generation

Reflected XSS in admin/manage-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort...

CVE-2020-10476: Improper Neutralization of Input During Web Page Generation

Reflected XSS in admin/manage-glossary.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort...

CVE-2020-10474: Improper Neutralization of Input During Web Page Generation

Reflected XSS in admin/manage-comments.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort...

CVE-2020-10473: Improper Neutralization of Input During Web Page Generation

Reflected XSS in admin/manage-categories.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort...

CVE-2020-10472: Improper Neutralization of Input During Web Page Generation

Reflected XSS in admin/manage-templates.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter sort...

CVE-2020-10468: Improper Neutralization of Input During Web Page Generation

Reflected XSS in admin/edit-news.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p...

CVE-2020-10467: Improper Neutralization of Input During Web Page Generation

Reflected XSS in admin/edit-comment.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p...

CVE-2020-10462: Improper Neutralization of Input During Web Page Generation

Reflected XSS in admin/edit-field.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p...

CVE-2020-10387: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files from the server using a dot-dot-slash sequence ../ via the GET parameter file...

CVE-2020-6201

The SAP Commerce Testweb Extension, versions- 6.6, 6.7, 1808, 1811, 1905, does not sufficiently encode user-controlled inputs, due to which certain GET URL parameters are reflected in the HTTP responses without escaping/sanitization, leading to Reflected Cross Site Scripting...

Mail.ru: turboslim.lady.mail.ru - Blind sql-injection.

Blind time based SQL injection in turboslim.lady.mail.ru promo page due to insecure use of GET parameter Уязвимость была в GET-параметре...

GHSA-PRG5-HG25-8GRQ Ability to switch channels via GET parameter enabled in production environments

Impact This vulnerability gives the ability to switch channels via the channelcode GET parameter in production environments. This was meant to be enabled only when %kernel.debug% is set to true. However, if no syliuschannel.debug is set explicitly in the configuration, the default value which is...

Ability to switch channels via GET parameter enabled in production environments

Impact This vulnerability gives the ability to switch channels via the channelcode GET parameter in production environments. This was meant to be enabled only when %kernel.debug% is set to true. However, if no syliuschannel.debug is set explicitly in the configuration, the default value which is...

CVE-2020-5218

Affected versions of Sylius give attackers the ability to switch channels via the channelcode GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no syliuschannel.debug is set explicitly in the configuration, the default value...

CVE-2020-5218

Affected versions of Sylius give attackers the ability to switch channels via the channelcode GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no syliuschannel.debug is set explicitly in the configuration, the default value...

CVE-2020-5218

Affected versions of Sylius give attackers the ability to switch channels via the channelcode GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no syliuschannel.debug is set explicitly in the configuration, the default value...

PT-2020-18316

Name of the Vulnerable Software and Affected Versions Sylius ResourceBundle versions prior to 1.3.13 Sylius ResourceBundle versions 1.3.0 through 1.3.12 Sylius ResourceBundle versions 1.4.0 through 1.4.5 Sylius ResourceBundle versions 1.5.0 Sylius ResourceBundle versions 1.6.0 through 1.6.2...