998 matches found
CVE-2021-37473
In NavigateCMS version 2.9.4 and below, function in product.php is vulnerable to sql injection on parameter products-order through a post request, which results in arbitrary sql query execution in the backend database...
CVE-2021-26753
NeDi 1.9C allows an authenticated user to inject PHP code in the System Files function on the endpoint /System-Files.php via the txt HTTP POST parameter. This allows an attacker to obtain access to the operating system where NeDi is installed and to all application data...
CVE-2021-35238
User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website...
CVE-2021-24909
The ACF Photo Gallery Field WordPress plugin before 1.7.5 does not sanitise and escape the post parameter in the includes/acfphotogallerymetaboxedit.php file before outputing back in an attribute, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-25007
The MOLIE WordPress plugin through 0.5 does not validate and escape a post parameter before using in a SQL statement, leading to an SQL Injection...
CVE-2021-35487
Nokia Broadcast Message Center through 11.1.0 allows an authenticated user to perform a Boolean Blind SQL Injection attack on the endpoint /owui/block/send-receive-updates for the Manage Alerts page via the extIdentifier HTTP POST parameter. This allows an attacker to obtain the database user,...
CVE-2021-24407
The Jannah WordPress theme before 5.4.5 did not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action, leading to a Reflected Cross-site Scripting XSS vulnerability...
CVE-2021-24322
The Database Backup for WordPress plugin before 2.4 did not escape the backuprecipient POST parameter in before output it back in the attribute of an HTML tag, leading to a Stored Cross-Site Scripting issue...
CVE-2021-24557
The update functionality in the rsliderpage uses an rsid POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role...
Linksys FGW3000-AH 注入漏洞
The Linksys FGW3000-AH is a wireless router from Linksys USA. An injection vulnerability exists in Linksys FGW3000-AH version 1.0.17.000000 and earlier, which stems from the HTTP POST request handler mishandling the parameter supplicantrndiden, which could lead to command injection...
CVE-2025-45779
Tenda AC10 V1.0reV15.03.06.46 is vulnerable to Buffer Overflow in the formSetPPTPUserList handler via the list POST parameter...
CVE-2025-45779
Tenda AC10 V1.0reV15.03.06.46 is vulnerable to Buffer Overflow in the formSetPPTPUserList handler via the list POST parameter...
CVE-2025-45779
Tenda AC10 V1.0reV15.03.06.46 is vulnerable to Buffer Overflow in the formSetPPTPUserList handler via the list POST parameter...
CVE-2025-46192
SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in userpaymentupdate.php via the orderid POST parameter...
CVE-2025-46189
SourceCodester Client Database Management System 1.0 is vulnerable to SQL Injection in userordercustomerupdate.php via the orderid POST parameter...
U.S. Dept Of Defense: POST XSS - fields[account][lastname] parameter
A cross-site scripting XSS vulnerability was discovered in the fieldsaccountlastname parameter of the POST request. The vulnerability allowed an attacker to inject malicious scripts that could be executed. This could potentially lead to consequences such as cookie theft and session hijacking...
CVE-2025-45017
A SQL injection vulnerability was discovered in edit-ticket.php of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary code via the tprice POST request parameter...
CVE-2025-32984
NETSCOUT nGeniusONE before 6.4.0 b2350 allows Stored Cross-Site Scripting XSS via a certain POST parameter...
