PT-2019-13507

Name of the Vulnerable Software and Affected Versions Ovidentia version 8.4.3 Description The issue is related to SQL Injection, which occurs via the id parameter in an "index.php?tg=delegat&idx=mem" request. Recommendations For Ovidentia version 8.4.3, avoid using the id parameter in the affecte...

PT-2019-13506

Name of the Vulnerable Software and Affected Versions Ovidentia version 8.4.3 Description The issue concerns a problem with index.php in Ovidentia, where there is a possibility of XSS via several specific parameters. The affected parameters include tg=groups, tg=maildoms&idx=create&userid=0&bgrp=...

PT-2019-13498

Name of the Vulnerable Software and Affected Versions Metinfo versions 6.x Description The issue allows SQL Injection via the id parameter in an "admin/index.php?n=ui set&m=admin&c=index&a=doget text content&table=lang&field=1" request. Recommendations For Metinfo version 6.x, consider restrictin...

CVE-2019-13978: Improper Neutralization of Special Elements used in an SQL Command

Ovidentia 8.4.3 has SQL Injection via the id parameter in an index.php?tg=delegat&idx=mem request...

CVE-2019-13977: Improper Neutralization of Input During Web Page Generation

index.php in Ovidentia 8.4.3 has XSS via tg=groups, tg=maildoms&idx=create&userid=0&bgrp=y, tg=delegat, tg=site&idx=create, tg=site&item=4, tg=admdir&idx=mdb&id=1, tg=notes&idx=Create, tg=admfaqs&idx=Add, or tg=admoc&idx=addoc&item=...

CVE-2019-13969: Improper Neutralization of Special Elements used in an SQL Command

Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=uiset&m=admin&c=index&a=dogettextcontent&table=lang&field=1 request...

Cross site scripting

index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment...

PT-2019-13489

Name of the Vulnerable Software and Affected Versions SyGuestBook A5 version 1.2 Description The issue is related to stored XSS that can be triggered via a reply to a comment. The specific endpoint involved is "index.php?c=admin&a=index". This allows for potential malicious script execution when ...

PT-2019-13488

Name of the Vulnerable Software and Affected Versions SyGuestBook A5 version 1.2 Description The issue concerns the lack of a CSRF protection mechanism. This is demonstrated through a CSRF attack on the index.php?c=Administrator&a=update endpoint, which allows for an admin password change...

CVE-2019-13950: Improper Neutralization of Input During Web Page Generation

index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment...

CVE-2019-13949: Cross-Site Request Forgery (CSRF)

SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change...

CVE-2019-1010028

phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting XSS. The impact is: Attack administrators and teachers, students and more. The component is: /pro-school/index.php?student/message/sendreply/. The attack vector is:...

PT-2019-11442

Name of the Vulnerable Software and Affected Versions: phpscriptsmall.com School College Portal with ERP Script versions 2.6.1 and earlier Description: The issue allows attackers to target administrators, teachers, and students. It involves a Cross Site Scripting XSS attack, which can be executed...

CVE-2019-13396

FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the forminclude parameter in an index.php?q=system-handle-form-submit POST request because of an includeonce in systemhandleformsubmit in modules/system/system.module...

CVE-2019-13396: Improper Limitation of a Pathname to a Restricted Directory

FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the forminclude parameter in an index.php?q=system-handle-form-submit POST request because of an includeonce in systemhandleformsubmit in modules/system/system.module...

CVE-2019-13472

PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file...

Cross site scripting

PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file...

CVE-2019-13472

PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file...

CVE-2019-13472

CVE-2019-13472 affects PHPWind 9.1.0. The vulnerability is an XSS issue in the index.php file, specifically in the c and m parameters. The connected documents confirm these are cross-site scripting vulnerabilities but do not provide exploitation details, affected versions beyond 9.1.0, or remedia...

PT-2019-13354

Name of the Vulnerable Software and Affected Versions PHPWind version 9.1.0 Description The issue concerns a security problem where an attacker can inject malicious scripts into the c and m parameters of the index.php file, potentially leading to unauthorized actions on the affected system...