13475 matches found
CVE-2020-35416: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admin login webpage with different request parameters, allows remote attackers to inject arbitrary web script or HTML...
PT-2020-17324
Name of the Vulnerable Software and Affected Versions EGavilan Barcodes generator version 1.0 Description The issue allows an attacker to inject a Cross Site Scripting XSS payload in the web application, which is executed every time a user visits the website. This occurs via the index.php file...
CVE-2020-35396: Improper Neutralization of Input During Web Page Generation
EGavilan Barcodes generator 1.0 is affected by: Cross Site Scripting XSS via the index.php. An Attacker is able to inject the XSS payload in the web application each time a user visits the website...
CVE-2020-29227: Undefined Security Weakness
An issue was discovered in Car Rental Management System 1.0. An unauthenticated user can perform a file inclusion attack against the /index.php file with a partial filename in the "page" parameter, to cause local file inclusion resulting in code execution...
Sourcecodester Car Rental Management System 输入验证错误漏洞
Sourcecodester Car Rental Management System is a car rental management system from Sourcecodester USA. A security vulnerability exists in version 1.0 of the SourceCodester Car Rental Management System, which can be exploited by an unauthenticated user to perform a file inclusion attack on the...
CVE-2020-29258
Cross-site scripting XSS vulnerability in Online Examination System 1.0 via the w parameter to index.php...
CVE-2020-29258
Cross-site scripting XSS vulnerability in Online Examination System 1.0 via the w parameter to index.php...
CVE-2020-29258
Cross-site scripting XSS vulnerability in Online Examination System 1.0 via the w parameter to index.php...
CVE-2020-29258: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Online Examination System 1.0 via the w parameter to index.php...
PT-2020-17127
Name of the Vulnerable Software and Affected Versions Online Examination System version 1.0 Description The issue is a cross-site scripting XSS vulnerability. It can be exploited via the w parameter to the "index.php" endpoint. This allows for potential malicious script injection and execution...
CVE-2020-28129
Stored Cross-site scripting XSS vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php?page=packages via vulnerable fields 'Package Name' and 'Description'...
Cross site scripting
Stored Cross-site scripting XSS vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php?page=packages via vulnerable fields 'Package Name' and 'Description'...
PT-2020-16930
Name of the Vulnerable Software and Affected Versions SourceCodester Online Library Management System version 1.0 Description The issue allows remote code execution via the "admin/borrower/index.php?view=add" endpoint because .php files can be uploaded to "admin/borrower/photos" under the web roo...
CVE-2020-28129: Improper Neutralization of Input During Web Page Generation
Stored Cross-site scripting XSS vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php?page=packages via vulnerable fields 'Package Name' and 'Description'...
CVE-2020-28130: Unrestricted Upload of File with Dangerous Type
An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct remote code execution via admin/borrower/index.php?view=add because .php files can be uploaded to admin/borrower/photos under the web root...
PT-2020-16656
Name of the Vulnerable Software and Affected Versions LionWiki versions prior to 3.2.12 Description The issue allows an unauthenticated user to read files as the web server user via a crafted string in the f1 variable in index.php, also known as Local File Inclusion. This affects products that ar...
CVE-2020-27191: Undefined Security Weakness
LionWiki before 3.2.12 allows an unauthenticated user to read files as the web server user via crafted string in the index.php f1 variable, aka Local File Inclusion. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
CVE-2020-28351
The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack via the PATHINFO to index.php due to insufficient validation for the timezone object in the HOMEMEETING& page...
PT-2020-16993
Name of the Vulnerable Software and Affected Versions Mitel ShoreTel version 19.46.1802.0 Description The issue allows an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient validation for the time zone object in the HOME MEETING& page, specifically...
