PT-2025-40370

Name of the Vulnerable Software and Affected Versions AndSoft e-TMS version 25.03 Description A cross-site scripting issue exists that allows an attacker to execute JavaScript code in a victim’s browser. This is achieved by sending a malicious URL. The issue is related to the l parameter in the...

CVE-2025-59747: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l' parameter in...

AndSoft e-TMS cross-site scripting vulnerabilities

AndSoft e-TMS is a logistics management software from AndSoft Spain. A cross-site scripting vulnerability exists in AndSoft e-TMS v25.03, which originates from the lack of effective filtering and escaping of user-supplied data in the parameters l, demo, demo2, TNTLOGIN, UO, and SuppConn in the fi...

AndSoft e-TMS cross-site scripting vulnerabilities

AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameters l, demo, demo2, TNTLOGIN, UO, and SuppConn in the file...

AndSoft e-TMS cross-site scripting vulnerabilities

AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameters l, demo, demo2, TNTLOGIN, UO, and SuppConn in the file...

AndSoft e-TMS cross-site scripting vulnerabilities

AndSoft e-TMS is a logistics management software from AndSoft Spain. A cross-site scripting vulnerability exists in AndSoft e-TMS, which stems from the lack of effective filtering and escaping of user-supplied data in the parameters l and reset of the /clt/changepassword.asp file, and can be...

CVE-2025-59748: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l' and 'reset' parameters in...

CVE-2025-59749: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l' parameter in...

PT-2019-7439

Name of the Vulnerable Software and Affected Versions RobotCPA plugin version 5 for WordPress Description The issue allows directory traversal via the l parameter in the f.php file. Recommendations For RobotCPA plugin version 5, consider restricting access to the f.php file until a patch is...

CVE-2015-9480: Improper Limitation of a Pathname to a Restricted Directory

The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter...

PT-2014-2858

Name of the Vulnerable Software and Affected Versions DDSN Interactive cm3 Acora CMS versions 5.5.0/1b-p1 through 6.0.6/1a Description The issue allows remote attackers to obtain sensitive information via a .. dot dot in the l parameter. This reveals the installation path in an error message...

CVE-2013-4728: Exposure of Sensitive Information to an Unauthorized Actor

DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, allows remote attackers to obtain sensitive information via a .. dot dot in the "l" parameter, which reveals the installation path in an error message...

CVE-2013-4723: Improper Input Validation

Open redirect vulnerability in DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the l parameter to track.aspx...

PT-2014-2853

Name of the Vulnerable Software and Affected Versions DDSN Interactive cm3 Acora CMS versions 5.5.0/1b-p1 through 6.0.6/1a Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the l parameter to "track.aspx"...

CVE-2011-1610: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in xmldirectorylist.jsp in the embedded Apache HTTP Server component in Cisco Unified Communications Manager aka CUCM, formerly CallManager 6.x before 6.15su3, 7.x before 7.15su4, 8.0 before 8.03asu2, and 8.5 before 8.51su1 allow remote attackers to execute...

PT-2011-3253

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager versions 6.x through 6.15su2, 7.x through 7.15su3, 8.0 through 8.03asu1, and 8.5 through 8.50su0 Description The issue allows remote attackers to execute arbitrary SQL commands via the f, l, or n parameter ...

CVE-2010-0154: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in sla/index.php in the Local Management Interface LMI on the IBM Proventia Network Mail Security System PNMSS appliance with firmware before 2.5 allows remote authenticated users to read arbitrary files via a .. dot dot in the l parameter, related to an "Insecur...

CVE-2010-2848: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in assets/captcha/includes/alikon/playcode.php in the InterJoomla ArtForms comartforms component 2.1b7.2 RC2 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the l parameter...

CVE-2009-2132

Directory traversal vulnerability in global.php in 4images before 1.7.7, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l parameter...

CVE-2009-2132: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in global.php in 4images before 1.7.7, when magicquotesgpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the l parameter...