Sql injection

Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /billing/home.php...

CVE-2023-27203: Improper Neutralization of Special Elements used in an SQL Command

Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /billing/home.php...

PT-2023-21002

Name of the Vulnerable Software and Affected Versions Best POS Management System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/billing/home.php" API endpoint. Recommendations For Best POS Management...

PT-2021-23894

Name of the Vulnerable Software and Affected Versions: Projectworlds Hospital Management System version 1.0 Description: The issue concerns SQL injection vulnerability via multiple parameters in the admin home.php file. Recommendations: For Projectworlds Hospital Management System version 1.0,...

Cross site scripting

A reflected cross-site scripting XSS vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remote attackers to inject arbitrary JavaScript and HTML via the PATHINFO to home.php...

CVE-2020-12679: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remote attackers to inject arbitrary JavaScript and HTML via the PATHINFO to home.php...

PT-2020-13200

Name of the Vulnerable Software and Affected Versions Mitel ShoreTel Conference Web Application versions 19.50.1000.0 through versions prior to MiVoice Connect 18.7 SP2 Description A reflected cross-site scripting XSS issue allows remote attackers to inject arbitrary JavaScript and HTML via the...

CVE-2016-10732

ProjectSend formerly cFTP r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?fileid=1, or process-zip-download.php, or adduserform parameters to users-add.php...

PT-2018-4898

Name of the Vulnerable Software and Affected Versions ProjectSend formerly cFTP version r582 Description The issue allows for authentication bypass through direct requests to specific files or parameters. This can be achieved by accessing "users.php", "home.php", "edit-file.php?file id=1", or...

CVE-2016-10732: Improper Authentication

ProjectSend formerly cFTP r582 allows authentication bypass via a direct request for users.php, home.php, edit-file.php?fileid=1, or process-zip-download.php, or adduserform parameters to users-add.php...

PT-2018-14581

Name of the Vulnerable Software and Affected Versions PhpTpoint Mailing Server Using File Handling version 1.0 Description The issue allows an attacker to read sensitive files on the system via directory traversal, bypassing the login page. This can be achieved by exploiting the Mailserver...

CVE-2018-18703: Improper Limitation of a Pathname to a Restricted Directory

PhpTpoint Mailing Server Using File Handling 1.0 suffers from multiple Arbitrary File Read vulnerabilities in different sections that allow an attacker to read sensitive files on the system via directory traversal, bypassing the login page, as demonstrated by the Mailserverfilesystem/home.php...

slavino.be XSS vulnerability

Open Bug Bounty ID: OBB-659757 Description| Value ---|--- Affected Website:| slavino.be Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-9786

Cross-site scripting XSS vulnerability in ProjectSend formerly cFTP before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in My account Name updated, related to home.php and actions-log.php...

CVE-2017-9786

Cross-site scripting XSS vulnerability in ProjectSend formerly cFTP before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in My account Name updated, related to home.php and actions-log.php...

CVE-2017-9786

Cross-site scripting XSS vulnerability in ProjectSend formerly cFTP before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in My account Name updated, related to home.php and actions-log.php...

CVE-2017-9786: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ProjectSend formerly cFTP before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca allows remote attackers to inject arbitrary web script or HTML via the Description field in My account Name updated, related to home.php and actions-log.php...

PT-2018-8534

Name of the Vulnerable Software and Affected Versions ProjectSend formerly cFTP versions before commit 6c3710430be26feb5371cb0377e5355d6f9a27ca Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the Description field in "My account Name...

performanceradiator.com XSS vulnerability

Open Bug Bounty ID: OBB-515307 Description| Value ---|--- Affected Website:| performanceradiator.com Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:...

tilda.ch XSS vulnerability

Open Bug Bounty ID: OBB-282865 Description| Value ---|--- Affected Website:| tilda.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...