1625 matches found
CVE-2018-18619
internal/advancedcommentsystem/admin.php in Advanced Comment System 1.0 is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query, allowing remote attackers to execute the sqli attack via a URL in the "page" parameter...
PT-2018-14542
Name of the Vulnerable Software and Affected Versions Advanced Comment System version 1.0 Description The issue arises from insufficient sanitization of user-supplied data in SQL queries, specifically allowing remote attackers to execute SQL injection attacks via the "page" parameter in a URL. Th...
CVE-2018-18619: Improper Neutralization of Special Elements used in an SQL Command
internal/advancedcommentsystem/admin.php in Advanced Comment System 1.0 is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query, allowing remote attackers to execute the sqli attack via a URL in the "page" parameter...
CVE-2018-18706
An issue was discovered on Tenda AC7 V15.03.06.44CN, AC9 V15.03.05.196318CN, AC10 V15.03.06.23CN, AC15 V15.03.05.19CN, and AC18 V15.03.05.196318CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "page" parameter of the function...
CVE-2018-18708
An issue was discovered on Tenda AC7 V15.03.06.44CN, AC9 V15.03.05.196318CN, AC10 V15.03.06.23CN, AC15 V15.03.05.19CN, and AC18 V15.03.05.196318CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "page" parameter of the function...
PT-2018-14586
Name of the Vulnerable Software and Affected Versions Tenda AC7 version 15.03.06.44 CN Tenda AC9 version 15.03.05.196318 CN Tenda AC10 version 15.03.06.23 CN Tenda AC15 version 15.03.05.19 CN Tenda AC18 version 15.03.05.196318 CN Description A buffer overflow issue exists in the router's web...
CVE-2018-18706: Improper Restriction of Operations within the Bounds of a Memory Buffer
An issue was discovered on Tenda AC7 V15.03.06.44CN, AC9 V15.03.05.196318CN, AC10 V15.03.06.23CN, AC15 V15.03.05.19CN, and AC18 V15.03.05.196318CN devices. It is a buffer overflow vulnerability in the router's web server -- httpd. When processing the "page" parameter of the function...
CVE-2018-15846
An issue was discovered in fledrCMS through 2014-02-03. There is a CSRF vulnerability that can change the administrator's password via index.php?p=done&savedata=1...
CVE-2018-15564
An issue was discovered in daveismyname simple-cms through 2014-03-11. There is a CSRF vulnerability that can delete any page via admin/?delpage=8...
CVE-2018-14929
Matera Banco 1.0.0 is vulnerable to multiple reflected XSS, as demonstrated by the /contingency/web/index.jsp aka home page url parameter...
Security Bulletin: OpenSource Apache Struts vulnerability in IBM Content Collector for Microsoft SharePoint
Summary Apache Struts could allow a remote attacker to bypass security restrictions, caused by an error in the MultiPageValidator implementation. An attacker could exploit this vulnerability using a modified page parameter to bypass restrictions and launch further attacks on the system...
PT-2018-16893
Name of the Vulnerable Software and Affected Versions SagePay Server Gateway for WooCommerce versions prior to 1.0.9 Description The issue concerns a problem with the SagePay Server Gateway for WooCommerce plugin, where there is a potential for XSS Cross-Site Scripting attacks. This occurs via th...
CVE-2018-5316: Improper Neutralization of Input During Web Page Generation
The "SagePay Server Gateway for WooCommerce" plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter...
Biometric Shift Employee Management System Arbitrary File Download Vulnerability
Biometric Shift Employee Management System is an employee management system. An arbitrary file download vulnerability exists in Biometric Shift Employee Management System. An attacker can download arbitrary files via a directory traversal sequence in the index.php formfilename parameter of the...
CVE-2017-17989
Biometric Shift Employee Management System has XSS via the index.php holidayname parameter in an editholiday action...
WordPress ResAds Plugin Cross-Site Scripting Vulnerability
WordPress is the WordPress Software Foundation of a set of PHP language development of blogging platform , the platform supports in PHP and MySQL server set up personal blog site.ResAds plugin is used in one of the display formatting plugin for adaptation to a variety of endpoints. A cross-site...
CVE-2015-7667: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in 1 templates/admanagement/admanagement.php and 2 templates/adspot/adspot.php in the ResAds plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter...
PT-2017-7253
Name of the Vulnerable Software and Affected Versions ResAds plugin versions prior to 1.0.2 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerabilities are located in the...
Piwigo 'name' Parameter Cross-Site Scripting Vulnerability
Piwigo is a web-based photo album software from Piwigo team. The software supports photo publishing, management, multiple browsing category, tag, time, etc. Batch Manager component is one of the manager components. A cross-site scripting vulnerability exists in Piwigo version 2.9.2. A remote...