PT-2023-30562 · Zoho · Manageengine Desktop Central

Name of the Vulnerable Software and Affected Versions: ManageEngine Desktop Central version 9.1.0 Description: A CRLF injection vulnerability has been found in ManageEngine Desktop Central. This vulnerability could allow a remote attacker to inject arbitrary HTTP headers and perform HTTP response...

CVE-2023-45323

Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'name' parameter of the routers/add-item.php resource does not validate the characters received and they are sent unfiltered to the database...

PT-2023-29412 · Unknown · Online Examination System

Name of the Vulnerable Software and Affected Versions: Online Examination System version 1.0 Description: The issue is related to multiple Unauthenticated SQL Injection vulnerabilities. The name parameter of the "feed.php" resource does not validate the characters received, and they are sent...

PT-2023-30269 · Unknown · Relativityone

Name of the Vulnerable Software and Affected Versions: RelativityOne versions 12.1.537.3 Patch 2 and earlier Description: The issue allows a remote attacker to execute arbitrary code via the name parameter. This enables the attacker to potentially gain unauthorized access and control over the...

TOTOLINK A3300R file_name parameter command injection vulnerability

The TOTOLINK A3300R is a wireless router manufactured by China's Gion Electronics TOTOLINK for home and small network environments. The TOTOLINK A3300R suffers from a command injection vulnerability that stems from the filename parameter of the UploadFirmwareFile function failing to properly filt...

CVE-2023-46976

TOTOLINK A3300R 17.0.0cu.557B20221024 contains a command injection via the filename parameter in the UploadFirmwareFile function...

CVE-2023-46976

TOTOLINK A3300R 17.0.0cu.557B20221024 contains a command injection via the filename parameter in the UploadFirmwareFile function...

PT-2023-30277 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description: The issue concerns a command injection via the file name parameter in the UploadFirmwareFile function. Recommendations: For TOTOLINK A3300R version 17.0.0cu.557 B20221024, avoid usin...

Online Blood Bank Management System Cross-Site Scripting Vulnerability

Online Blood Bank Management System is an online blood bank management system. A cross-site scripting vulnerability exists in Online Blood Bank Management System v1.0, which originates when the firstName parameter of users/register.php is copied in plain text to the users/member.php document...

TOTOLINK A3300R 安全漏洞

The TOTOLINK A3300R is a wireless router manufactured by China's Gion Electronics TOTOLINK for home and small network environments. The TOTOLINK A3300R suffers from a command injection vulnerability that stems from the filename parameter of the UploadFirmwareFile function failing to properly filt...

Directory traversal

Xpand IT Write-back manager v2.3.1 allows attackers to perform a directory traversal via modification of the siteName parameter...

CVE-2023-46370

Tenda W18E V16.01.0.81576 has a command injection vulnerability via the hostName parameter in the formSetNetCheckTools function...

PT-2023-8496 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3700R version 9.1.2u.6165 20211012 Description: An issue in the UploadFirmwareFile function allows a remote attacker to execute arbitrary code via the FileName parameter. This is due to the lack of input data sanitization when...

CVE-2023-27148

A stored cross-site scripting XSS vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Role Name parameter...

CVE-2023-27148

A stored cross-site scripting XSS vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Role Name parameter...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Role Name parameter...

CVE-2023-5699

A vulnerability, which was classified as problematic, has been found in CodeAstro Internet Banking System 1.0. This issue affects some unknown processing of the file pagesviewclient.php. The manipulation of the argument accname with the input Johnnie Reyes'"&%alert5646 leads to cross site...

Enhancesoft osTicket Cross-Site Scripting Vulnerability

Enhancesoft osTicket is an open source ticketing system from Enhancesoft, USA. A security vulnerability exists in Enhancesoft osTicket v1.17.2. An attacker can exploit this vulnerability to execute arbitrary web script or HTML via a specially crafted payload injected into the Role Name parameter...

CVE-2023-27148

A stored cross-site scripting XSS vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Role Name parameter...

CVE-2023-27148

A stored cross-site scripting XSS vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Role Name parameter...