3249 matches found
PT-2023-12943 · Totolink · Totolink Outdoor Cpe Cp900
Name of the Vulnerable Software and Affected Versions: TOTOLink outdoor CPE CP900 version 6.3c.566 B20171026 Description: The issue concerns a command injection vulnerability in the NTPSyncWithHost function via the host name parameter. This allows attackers to execute arbitrary commands via a...
Simple Customer Relationship Management SQL注入漏洞
Simple Customer Relationship Management Simple CRM is a simple customer relationship management system by Carlo Montero, a personal developer. A SQL injection vulnerability exists in Simple Customer Relationship Management System v1.0, which can be exploited to perform SQL injection via the name...
TOTOLINK CP900 操作系统命令注入漏洞
The TOTOLINK CP900 is a wireless router from China-based TOTOLINK. The TOTOLINK CP900 suffers from an operating system command injection vulnerability that stems from a command injection issue in the hostname parameter of the NTPSyncWithHost function...
CVE-2023-27054
A cross-site scripting XSS vulnerability in MiroTalk P2P before commit f535b35 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the settings module...
Cross site scripting
A cross-site scripting XSS vulnerability in MiroTalk P2P before commit f535b35 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the settings module...
CVE-2023-28664
The Meta Data and Taxonomies Filter WordPress plugin, in versions 1.3.1, is affected by a reflected cross-site scripting vulnerability in the 'taxname' parameter of the mdfgettaxoptionsinwidget action, which can only be triggered by an authenticated user...
Sql injection
The Events Made Easy WordPress Plugin, version = 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'searchname' parameter in the emerecurrenceslist action...
PT-2023-21886 · WordPress · Meta Data/Taxonomies Filter
Name of the Vulnerable Software and Affected Versions: Meta Data and Taxonomies Filter WordPress plugin versions prior to 1.3.1 Description: The issue is a reflected cross-site scripting vulnerability in the tax name parameter of the mdf get tax options in widget action. This can only be triggere...
PT-2023-17085 · Sourcecodester · Sourcecodester E-Commerce System
Name of the Vulnerable Software and Affected Versions: SourceCodester E-Commerce System version 1.0 Description: A problematic vulnerability was found in the SourceCodester E-Commerce System. The issue affects an unknown functionality of the file admin/user/controller.php?action=edit. The...
SourceCodester E-Commerce System 跨站脚本漏洞
Moosikay E-Commerce System is an e-commerce system by the individual developer Arvin Arandilla. A cross-site scripting vulnerability exists in SourceCodester E-Commerce System version 1.0, which stems from a problem with the file admin/user/controller.php?action=edit, where manipulation of the...
PT-2023-16952 · Sourcecodester · Sourcecodester Yoga Class Registration System
Name of the Vulnerable Software and Affected Versions: SourceCodester Yoga Class Registration System version 1.0 Description: A vulnerability was found in the SourceCodester Yoga Class Registration System. It affects the function query of the file admin/user/list.php. The manipulation of the name...
Atlassian Jira < 6.0.5 Multiple Vulnerabilities
According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 6.0.5. It is, therefore, affected by multiple vulnerabilities: - A directory traversal in the Importers Plugin which permits remote attackers to create arbitrary files...
CVE-2023-27063
Tenda V15V1.0 V15.11.0.14152131901058 was discovered to contain a buffer overflow vulnerability via the DNSDomainName parameter in the formModifyDnsForward function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...
CVE-2023-1374
The Solidres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'currencyname' parameter in versions up to, and including, 0.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator privileges to...
Tenda W15E 安全漏洞
Tenda W15E is a wireless router from Tenda China. A security vulnerability exists in the Tenda W15E V1.0 V15.11.0.14 152131901058 version, which originates from the discovery of a contain you buffer overflow vulnerability via the DNSDomainName parameter in the formModifyDnsForward function...
Online Ordering System 跨站脚本漏洞
Online Ordering System is a multi-store ordering system for janobe individual developers. It can be used for any small business. A cross-site scripting vulnerability exists in SourceCodester Gadget Works Online Ordering System version 1.0, which stems from a problem with the file...
SourceCodester Computer Parts Sales and Inventory System 跨站脚本漏洞
Computer Parts Sales and Inventory System is a computer parts sales and inventory system by Warren Daloyan, an individual developer. A cross-site scripting vulnerability exists in SourceCodester Computer Parts Sales and Inventory System version 1.0, which stems from unknown problematic code in th...
D-Link Routers Unauthenticated RCE (CVE-2022-26258)
The remote D-Link router is affected by a remote code execution vulnerability. D-Link DIR-820L 1.05B03 was discovered to contain a remote command execution RCE vulnerability via the Device Name parameter in /lan.asp. Note that Nessus has not tested for this issue but has instead relied only on th...
CVE-2022-47075
An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx...
