CVE-2022-33116: Improper Limitation of a Pathname to a Restricted Directory

An issue in the jmpath variable in /modules/mindmap/index.php of GUnet Open eClass Platform aka openeclass v3.12.4 and below allows attackers to read arbitrary files via a directory traversal...

CVE-2022-2212: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in SourceCodester Library Management System 1.0. It has been classified as critical. Affected is an unknown function of the component /card/index.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The...

PT-2022-15255

Name of the Vulnerable Software and Affected Versions SourceCodester Library Management System version 1.0 Description A critical issue was found in the system, affecting an unknown function of the /card/index.php component. The manipulation of the image argument leads to unrestricted upload. Thi...

CVE-2021-39408

Cross Site Scripting XSS vulnerability exists in Online Student Rate System 1.0 via the page parameter on the index.php file...

CVE-2021-39408

Cross Site Scripting XSS vulnerability exists in Online Student Rate System 1.0 via the page parameter on the index.php file...

CVE-2021-39408

The CVE-2021-39408 entry applies to Online Student Rate System v1.0. Affected: index.php page parameter handling in the application. Root cause: lack of input validation/escaping of user-supplied data in the page parameter leading to Cross-Site Scripting (XSS). Impact: attacker could cause client...

CVE-2022-30117

Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changin...

PT-2022-20008

Name of the Vulnerable Software and Affected Versions Concrete versions 8.5.7 and below Concrete versions 9.0 through 9.0.2 Description The issue allows traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing...

Online Student Rate System 跨站脚本漏洞

Online Student Rate System is an online grading system for students. v1.0 of the Online Student Rate System is vulnerable to a cross-site scripting vulnerability that stems from a lack of validation filtering of user-supplied data and output data in the page parameter of the index.php file. An...

CVE-2022-30117: Improper Limitation of a Pathname to a Restricted Directory

Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changin...

CVE-2021-39408: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability exists in Online Student Rate System 1.0 via the page parameter on the index.php file...

PT-2022-10910

Name of the Vulnerable Software and Affected Versions Online Student Rate System version 1.0 Description A Cross Site Scripting XSS issue exists via the page parameter on the "index.php" file. This allows for potential malicious script execution. Recommendations For Online Student Rate System...

Cross site scripting

PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=authorsee request to index.php...

Cross-site Scripting (XSS)

microweber/microweber is vulnerable to cross-site scriptingXSS attacks. A remote attacker is able to inject and execute malicious javascript via bypassing XSS filters in index.php, resulting in cookie stealing and account takeover...

CVE-2022-34328: Improper Neutralization of Input During Web Page Generation

PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=authorsee request to index.php...

CVE-2022-31062: Improper Limitation of a Pathname to a Restricted Directory

Impact A plugin public script can be used to read content of system files. Patches Upgrade to version 1.0.2. Workarounds b/deploy/index.php file can be deleted if deploy feature is not used...

CVE-2022-31062

Impact A plugin public script can be used to read content of system files. Patches Upgrade to version 1.0.2. Workarounds "b/deploy/index.php" file can be deleted if deploy feature is not used...

PT-2022-20712

Name of the Vulnerable Software and Affected Versions Online Ordering System version 2.3.2 Description The issue is related to a SQL injection vulnerability. It can be exploited via the "/ordering/admin/store/index.php?view=edit&id=" API endpoint, specifically through the id variable. This...

CVE-2022-31357: Improper Neutralization of Special Elements used in an SQL Command

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=...

PT-2022-20711

Name of the Vulnerable Software and Affected Versions Online Ordering System version 2.3.2 Description The issue is related to a SQL injection vulnerability. It can be exploited via the "/ordering/index.php?q=category&search=" API endpoint. The search parameter is vulnerable. Recommendations For...