KB Affiliate Referral Script SQL注入漏洞

KB Affiliate Referral Script is a 3-tier referral system by Kunal Bansal Personal Developer. A security vulnerability exists in KB Affiliate Referral Script version 1.0, which can be exploited to cause a sql injection by typing the username/password parameters into the /index.php file. The attack...

Microweber 跨站脚本漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site scripting vulnerability exists in Microweber versions prior to 1.2.17, whic...

PT-2022-20499 · Plugin · Plugin

Name of the Vulnerable Software and Affected Versions: Plugin versions prior to 1.0.2 Description: A plugin public script can be used to read the content of system files. Recommendations: For versions prior to 1.0.2, upgrade to version 1.0.2. As a temporary workaround, consider deleting the...

CVE-2021-41755

dynamicMarkt = 3.10 is affected by SQL injection in the kat1 parameter of index.php...

CVE-2021-41754

dynamicMarkt = 3.10 is affected by SQL injection in the parent parameter of index.php...

phpABook SQL注入漏洞

phpABook is a simple address/contact management system using PHP and MySQL. phpABook version 0.9i is vulnerable to a SQL injection vulnerability caused by a failure to properly clean up the "authuser" parameter in the index.php script. An attacker could use this vulnerability to execute illegal S...

Halibut 资源管理错误漏洞

Halibut is a secure, RPC-based open source communication framework from the individual developers of Octopus Deploy. A security vulnerability exists in Halibut version 1.2, which stems from a post-release reuse issue in cleanupindex in index.c. The vulnerability is caused by an unspecified text...

KevinLAB Building Energy Management System SQL注入漏洞

KevinLAB Building Energy Management System is a building energy management system from KevinLAB Korea. SQL injection vulnerability exists in KevinLAB Building Energy Management System version 4ST BEMS 1.0.0, which originates from a missing validation of external input SQL statements in the inputi...

CVE-2022-26980

Teampass 2.1.26 allows reflected XSS via the index.php PATHINFO...

CVE-2022-25481

ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode...

phpLiteAdmin 跨站脚本漏洞

phpLiteAdmin is a web-based SQLite database management tool. phpLiteAdmin versions prior to 1.9.8.2 are vulnerable to cross-site scripting. The vulnerability stems from a newRows parameter in index.php that lacks a data validation filter for user-supplied data and output. An attacker could use th...

BloofoxCms 跨站脚本漏洞

BloofoxCms is a Php-based text content management system from alexlang24 personal developer. bloofoxCMS suffers from a cross-site scripting vulnerability that stems from the lack of user-supplied data and output data validation filtering in the file and type parameters in index.php. An attacker...

CVE-2021-44892

A Remote Code Execution RCE vulnerability exists in ThinkPHP 3.x.x via valuefilename in index.php, which could let a malicious user obtain server control privileges...

ThinkPHP 安全漏洞

ThinkPHP is a PHP-based, open source, lightweight web application development framework from China's Top Thinking Information Technology Company. A security vulnerability exists in ThinkPHP, which stems from a Remote Code Execution RCE vulnerability in ThinkPHP 3.x. An attacker can exploit this...

GHSA-926X-M6M5-3MMP push-dir Enables OS Command Injection

push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable opt.branch is not validated before being provided to the git command within index.jsL139. This could be abused by an attacker to inject arbitrary commands...

CVE-2021-45286

Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1 index.php, 2 bottom.php, and 3 topindex.php...

CVE-2022-23363

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via index.php...

The vulnerability in the index.php script of the D-Link DSL-3782 router’s microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the index.php script in the D-Link DSL-3782 router microprogramming system is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Employee Record Management System index.php File SQL Injection Vulnerability

Employee Record Management System is an employee record management system. Employee Record Management System has a SQL injection vulnerability that originates from an SQL injection bypass authentication vulnerability via index.php, which can be exploited by an attacker to corrupt, alter, or...

CVE-2021-40260

Multiple Cross Site Scripting XSS vulnerabilities exist in SourceCodester Tailor Management 1.0 via the 1 eid parameter in a partedit.php and b customeredit.php, the 2 id parameter in a editmeasurement.php and b addpayment.php, and the 3 error parameter in index.php...