PT-2021-15380 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.1.0 through 3.9.23 Description: The issue is related to the lack of escaping of image-related parameters in multiple com tags views, which can lead to XSS attack vectors. Recommendations: For Joomla! versions 3.1.0 through...

CVE-2019-14251

An issue was discovered in T24 in TEMENOS Channels R15.01. The login page presents JavaScript functions to access a document on the server once successfully authenticated. However, an attacker can leverage downloadDocServer to traverse the file system and access files or directories that are...

Cross site scripting

Cross-site scripting XSS vulnerability in the photo gallery model in Exis Contexis before 2.0 allows remote attackers to inject arbitrary web script or HTML via the image parameter in a detail action...

CVE-2016-10758

PHPKIT 1.6.6 allows arbitrary File Upload, as demonstrated by a .php file to pkinc/admin/mediaarchive.php and pkinc/func/default.php via the imagename parameter...

PHPSUGAR PHP Melody SQL Injection Vulnerability (CNVD-2017-32539)

PHPSUGAR PHP Melody is a PHP-based content management system for video websites. A SQL injection vulnerability exists in PHPSUGAR PHP Melody versions prior to 2.7.3. A remote attacker can exploit this vulnerability by sending the 'image' parameter to the admin/editcategory.php file to inject SQL...

CVE-2017-15578

In PHPSUGAR PHP Melody before 2.7.3, SQL Injection exists via the image parameter to admin/editcategory.php...

CVE-2017-9555

Cross-site scripting XSS vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

CVE-2017-9555

Cross-site scripting XSS vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

CVE-2017-9555

Cross-site scripting XSS vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

Gratipay: Application-level DoS on image's "size" parameter.

Summary --- The size parameter located on images is vulnerable to DoS. By modifying the parameter's value an attacker can cause the application to work very slowly. Description --- The issue is located in the getimageurl function in gratipay/models/team/init.py and can be exploited by replacing t...

Code injection

Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by 1 changing "PHPSESSID" to an array; 2 adding non-alphanumeric chars to "PHPSESSID"; 3 changing the image parameter to an array; or 4 changing the image parameter to a string, which reveals the installation path in an error...

DouPHP admin/article.php image parameter SQL injection

No description provided by source...

CVE-2014-9562

Cross-site scripting XSS vulnerability in displaydialog.php in M2 OptimalSite 0.1 and 2.4 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in displaydialog.php in M2 OptimalSite 0.1 and 2.4 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

Oracle Java SE Multiple Vulnerabilities -01 March 13 (Windows)

This host is installed with Oracle Java SE and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gboraclejavasemultvuln01mar13win.nasl 7699 2017-11-08 12:10:34Z santu $ Oracle Java SE Multiple Vulnerabilities -01 March 13 Windows Authors: Arun Kallavi Copyright: Copyright c 20...

Cross site scripting

Cross-site scripting XSS vulnerability in image/view.php in CANDID allows remote attackers to inject arbitrary web script or HTML via the imageid parameter...

CVE-2011-0773

Cross-site scripting XSS vulnerability in pivotx/modules/moduleimage.php in PivotX before 2.2.3 allows remote attackers to inject arbitrary web script or HTML via the image parameter...

Directory traversal

Directory traversal vulnerability in gallery/gallery.php in Wap-Motor before 18.1 allows remote attackers to read arbitrary files via a .. dot dot in the image parameter...

Sql injection

Multiple SQL injection vulnerabilities in Qsoft K-Rate Premium allow remote attackers to execute arbitrary SQL commands via 1 the $id variable in admin/includes/delecpac.php, 2 $ordorderid variable in payments/paymentreceived.php, 3 $id variable in includes/functions.php, and 4 unspecified...

CVE-2009-1809

Multiple cross-site scripting XSS vulnerabilities in myColex 1.4.2 allow remote attackers to inject arbitrary web script or HTML via 1 the year parameter to modules/kalender.php, 2 the Page parameter in a List action to modules/ereignis.php, 3 the Kontext parameter in a Search action to...