232 matches found
Gxlcms Cross-Site Scripting Vulnerability
Gxlcms is an enterprise website creation system. A cross-site scripting vulnerability exists in Gxlcms version 1.0, which can be exploited by remote attackers to inject arbitrary Web script or HTML by sending PATHINFO to the file gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php...
spring-framework: Improper URL path validation allows for bypassing of security checks on static resources
Spring Security Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3 does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an...
MantisBT Cross-Site Scripting Vulnerability (CNVD-2018-14791)
MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A cross-site scripting vulnerability exists in the View Filters page viewfilterspage.php in MantisBT versions 2.1.0...
PT-2018-12277
Name of the Vulnerable Software and Affected Versions WolfSight CMS version 3.2 Description The issue allows SQL injection via the PATH INFO to the default URI. Recommendations For WolfSight CMS version 3.2, consider restricting access to the default URI to minimize the risk of exploitation. As a...
TP-Link Archer C1200 Cross-Site Scripting Vulnerability
TP-Link Archer C1200 is a wireless router product from China P&L TP-LINK. A cross-site scripting vulnerability exists in the TP-Link Archer C1200 1.13 Build 2018/01/24 rel.52299 EU version, which stems from the program's failure to filter special characters or illegitimate input. A remote attacke...
CVE-2018-13134
TP-Link Archer C1200 1.13 Build 2018/01/24 rel.52299 EU devices have XSS via the PATHINFO to the /webpages/data URI...
CVE-2018-12254
router.php in the Harmis Ek rishta aka ek-rishta 2.10 component for Joomla! allows SQL Injection via the PATHINFO to a home/requesteduser/Sent%20interest/ URI...
CVE-2017-14536
trixbox 2.8.0.4 has XSS via the PATHINFO to /maint/index.php or /user/includes/language/langChooser.php...
Joomla! Tumder SQL Injection Vulnerability
Joomla! is a U.S. Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds, site search and other features.Tumder is used in one of the arcade game components. A SQL injection vulnerability exists in version 2.1 of Joomla! A remote...
CVE-2018-5984
SQL Injection exists in the Tumder An Arcade Games Platform 2.1 component for Joomla! via the PATHINFO to the category/ URI...
Vanguard Marketplace Digital Products PHP SQL Injection Vulnerability
Vanguard Marketplace Digital Products PHP is a set of PHP-based scripts for online trading sites for MP3 and other digital files. A SQL injection vulnerability exists in Vanguard Marketplace Digital Products PHP version 1.4. A remote attacker can inject SQL commands by sending PATHINFO to the /p...
CVE-2017-17873
Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATHINFO to the /p URI...
CVE-2017-17607
CMS Auditor Website 1.0 has SQL Injection via the PATHINFO to /news-detail...
CVE-2017-17572
FS Amazon Clone 1.0 has SQL Injection via the PATHINFO to /VerAyari...
Cacti cross-site scripting vulnerability (CNVD-2017-36486)
Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool through snmpget to get the data , using RRDtool drawing graphs to analyze , and provide data and user management features . A cross-site scripting vulnerability exists in Cacti version 1.1.27...
DEBIAN-CVE-2017-16785
Cacti 1.1.27 has reflected XSS via the PATHINFO to host.php...
PG All Share Video SQL Injection Vulnerability
PG All Share Video is a set of video sharing website scripts. A SQL injection vulnerability exists in PG All Share Video version 1.0. A remote attacker can exploit this vulnerability by sending PATHINFO to search/tag, friends/index, or users/profile to inject SQL commands...
Job Board Script Software SQL Injection Vulnerability
Job Board Script Software is a web-based recruitment system. The system supports online resume creation, job application and job search report writing. A SQL injection vulnerability exists in Job Board Script Software. A remote attacker can exploit this vulnerability by sending PATHINFO to the...
Webmin Cross-Site Request Forgery Vulnerability (CNVD-2017-32345)
Webmin is a web-based system administration tool for Unix-like operating systems developed by Australian software developer Jamie Cameron and the Webmin community. A server-side request forgery vulnerability exists in Webmin 1.850, which arises from the program's failure to adequately filter user...
