CVE-2019-10852: Improper Neutralization of Special Elements used in an SQL Command

Computrols CBAS 18.0.0 allows Authenticated Blind SQL Injection via the id GET parameter, as demonstrated by the index.php?m=servers&a=startpulling&id= substring...

PT-2019-12056

Name of the Vulnerable Software and Affected Versions Computrols CBAS version 18.0.0 Description The issue allows authenticated blind SQL injection via the id GET parameter in the "index.php?m=servers&a=start pulling&id=" endpoint. This can be exploited as demonstrated by injecting a substring in...

Sql injection

sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadminceditpost cvalue parameter...

PT-2019-12718

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.7 Description The issue allows SQL Injection via the cvalue parameter in the "index.php?do=sadmin ceditpost" endpoint. Recommendations For UCMS version 1.4.7, avoid using the cvalue parameter in the "index.php?do=sadmin...

CVE-2019-12251: Improper Neutralization of Special Elements used in an SQL Command

sadmin/ceditpost.php in UCMS 1.4.7 allows SQL Injection via the index.php?do=sadminceditpost cvalue parameter...

Sql injection

The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...

CVE-2018-18800

The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...

PT-2019-9632

Name of the Vulnerable Software and Affected Versions Tubigan "Welcome to our Resort" version 1.0 Description The issue allows SQL Injection, which can be exploited through specific API endpoints, such as "index.php?p=accomodation&q=SQL", "index.php?p=rooms&q=SQL", or "admin/login.php"...

CVE-2018-18800: Improper Neutralization of Special Elements used in an SQL Command

The Tubigan "Welcome to our Resort" 1.0 software allows SQL Injection via index.php?p=accomodation&q=SQL, index.php?p=rooms&q=SQL, or admin/login.php...

Cross site scripting

Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation...

CVE-2018-16625

index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...

CVE-2018-16626

CVE-2018-16626 affects Typesetter 5.1: index.php/Admin/Classes allows cross-site scripting via the description of a new class name. The vulnerability is an XSS in the class-creation workflow, arising from how the description field is processed in Admin/Classes. Public references in the connected ...

CVE-2018-16639

CVE-2018-16639 affects Typesetter 5.1. The vulnerability allows a Cross-Site Scripting (XSS) attack via the index.php/Admin LABEL parameter during new page creation, stemming from insufficient validation of client-side data. Public sources (NVD, RH/Red Hat, OSV, CNVD, CVE List, etc.) consistently...

CVE-2018-16639: Improper Neutralization of Input During Web Page Generation

Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation...

PT-2019-9360

Name of the Vulnerable Software and Affected Versions Typesetter version 5.1 Description The issue allows for XSS via an SVG file with JavaScript in a SCRIPT element, specifically in the index.php/Admin/Uploaded component. Recommendations For version 5.1, consider restricting access to the...

PT-2019-9362

Name of the Vulnerable Software and Affected Versions Typesetter version 5.1 Description The issue allows for XSS via the LABEL parameter in the "index.php/Admin" endpoint during new page creation. Recommendations For version 5.1, avoid using the LABEL parameter in the "index.php/Admin" endpoint...

PT-2019-9361

Name of the Vulnerable Software and Affected Versions Typesetter version 5.1 Description The issue allows for XSS via the description of a new class name in the index.php/Admin/Classes endpoint. Recommendations For version 5.1, update to a newer version that contains a fix for this issue, or as a...

CVE-2018-16625: Improper Neutralization of Input During Web Page Generation

index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...

CVE-2018-16626: Improper Neutralization of Input During Web Page Generation

index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name...

CVE-2017-12790

Metinfo 5.3.18 is affected by: Cross Site Request Forgery CSRF. The impact is: Information Disclosure remote. The component is: admin/index.php. The attack vector is: The administrator clicks on the malicious link in the login state...