CVE-2021-42665

CVE-2021-42665 affects the Sourcecodester Engineers Online Portal (PHP) via the login.php form. The vulnerability is an SQL Injection in the authentication routine that can allow bypassing login without valid credentials. Affected component is the login mechanism (username/password fields), with ...

CVE-2021-42665

An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication...

PT-2021-23646

Name of the Vulnerable Software and Affected Versions Sourcecodester Engineers Online Portal affected versions not specified Description A security issue exists in the login form of the Sourcecodester Engineers Online Portal, specifically in the index.php file, allowing an attacker to bypass...

CVE-2021-42665: Improper Neutralization of Special Elements used in an SQL Command

An SQL Injection vulnerability exists in Sourcecodester Engineers Online Portal in PHP via the login form inside of index.php, which can allow an attacker to bypass authentication...

PT-2021-5308

Name of the Vulnerable Software and Affected Versions Sourcecodester Online Event Booking and Reservation System affected versions not specified Description The issue exists due to the lack of measures to neutralize special elements, allowing a remote attacker to exploit it and potentially disclo...

CVE-2021-39412: Improper Neutralization of Input During Web Page Generation

Multiple Cross Site Scripting XSS vulnerabilities exists in PHPGurukul Shopping v3.1 via the 1 callback parameter in a serverside/scripts/idjsonp.php, b serverside/scripts/jsonp.php, and c scripts/objectsjsonp.php, the 2 value parameter in examplessupport/editableajax.php, and the 3 PHPSELF...

Sql injection

SQL Injection vulnerability in eyoucms cms v1.4.7, allows attackers to execute arbitrary code and disclose sensitive information, via the tid parameter to index.php...

CVE-2020-24000: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in eyoucms cms v1.4.7, allows attackers to execute arbitrary code and disclose sensitive information, via the tid parameter to index.php...

PT-2021-10996

Name of the Vulnerable Software and Affected Versions: eyoucms cms version 1.4.7 Description: The issue allows attackers to execute arbitrary code and disclose sensitive information. This is achieved via the tid parameter to the "index.php" endpoint. Recommendations: For eyoucms cms version 1.4.7...

xujinliang zibbs cross-site scripting vulnerability

Zibbs Zibbs Forum is a Bootstrap-based Php light forum system. xujinliang zibbs version 1.0 is vulnerable to a cross-site scripting vulnerability that stems from a lack of effective filtering and escaping of the route parameter in index.php. An attacker could use this vulnerability to execute...

PT-2021-10567

Name of the Vulnerable Software and Affected Versions: shadoweb wdja version 1.5.1 Description: A Cross Site Scripting XSS issue allows attackers to execute arbitrary code and gain escalated privileges via the backurl parameter to the "/php/passport/index.php" endpoint. Recommendations: For...

Cross site scripting

Cross site scripting XSS vulnerability in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the route parameter to index.php...

PT-2021-10936

Name of the Vulnerable Software and Affected Versions zibbs version 1.0 Description A cross-site scripting XSS issue allows attackers to execute arbitrary code via the route parameter to "index.php". This could potentially lead to unauthorized actions on the affected system. Recommendations For...

CVE-2020-23718: Improper Neutralization of Input During Web Page Generation

Cross site scripting XSS vulnerability in xujinliang zibbs 1.0, allows attackers to execute arbitrary code via the route parameter to index.php...

CVE-2021-36548

A remote code execution RCE vulnerability in the component /admin/index.php?id=themes&action=edittemplate&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary commands via a crafted PHP file...

CVE-2021-36548: Unrestricted Upload of File with Dangerous Type

A remote code execution RCE vulnerability in the component /admin/index.php?id=themes&action=edittemplate&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary commands via a crafted PHP file...

PT-2021-21286

Name of the Vulnerable Software and Affected Versions Monstra version 3.0.4 Description A remote code execution issue in the /admin/index.php?id=themes&action=edit template&filename=blog component allows attackers to execute arbitrary commands via a crafted PHP file. Recommendations For Monstra...

openSIS SQL Injection

The vulnerability of the information system openSIS is related to the failure to implement measures to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries using the index.php USERNAME parameter...

SQL Injection in flatcore/flatcore-cms

Pre-Auth SQL injection Description flatCore-CMS is vulnerable to variable-overwritten vulnerability, leading to a Pre-Auth SQL injection in index.php ​ source code 1 at index.phpL41 php $fcprefs = fcgetpreferences; $languagePack = $fcprefs'prefsdefaultlanguage'; $SESSION'fcadminhelpers' = array; ...

CVE-2020-28145

Arbitrary file deletion vulnerability was discovered in wuzhicms v 4.0.1 via coreframe\app\attachment\admin\index.php, which allows attackers to access sensitive information...