itsourcecode Tailoring Management System 注入漏洞

itsourcecode Tailoring Management System is a customized management system from itsourcecode open source. An injection vulnerability exists in version 1.0 of itsourcecode Tailoring Management System, which stems from the parameters id/address/fullname/phonenumber/email/city/comment in the file...

Selesta Visual Access Manager SQL Injection Vulnerability (CNVD-2025-22315)

Selesta Visual Access Manager is a visual access manager from Selesta. A SQL injection vulnerability exists in Selesta Visual Access Manager, which can be exploited by an attacker to perform SQL injection in multiple parameters of /monitor/snormalizedtrans.php...

Code-Projects Pharmacy Management System SQL注入漏洞

Code-Projects Pharmacy Management System is a Code-Projects open source pharmacy management system. Code-Projects Pharmacy Management System version 1.0 has a SQL injection vulnerability that originates from the parameter name/packing/genericname/suppliers in the file /php/managemedicinestock.php...

CVE-2024-4333

The Sina Extension for Elementor Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via several parameters in versions up to, and including, 3.5.3 due to insufficient input...

EUVD-2024-26384

CSV Injection vulnerability in Addactis IBNRS v.3.10.3.107 allows a remote attacker to execute arbitrary code via a crafted .ibnrs file to the Project Description, Identifiers, Custom Triangle Name inside Input Triangles and Yield Curve Name parameters...

CVE-2023-29215 Apache Linkis JDBC EngineCon has a deserialization command execution

In Apache Linkis =1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn Module will trigger a deserialization vulnerability and eventually lead to remote code execution. Therefore, the parameters in the Mysql JDBC...

Input validation

Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users.This issue affects Library Automation System: before 19.2...

CVE-2021-4105

CVE-2021-4105 affects BG-TEK COSLAT Firewall (versions 5.24.0.R.20180630 through 5.24.0.R.20210727). The root cause is improper handling of parameters, enabling Remote Code Inclusion. Impact is unauthenticated remote code execution with high risk to confidentiality, integrity, and availability (p...

CVE-2022-36668

Garage Management System 1.0 is vulnerable to Stored Cross Site Scripting XSS on several parameters. The vulnerabilities exist during creating or editing the parts under parameters. Using the XSS payload, the Stored XSS triggered and can be used for further attack vector...

H3C H200 缓冲区错误漏洞

The H3C H200 is a type of full gigabit home smart hub from China's Xinhua San H3C. A security vulnerability exists in the H3C H200 H200V100R004 version that stems from a stack overflow in the UpdateIpv6Params method...

Sql injection

Improper Handling of Parameters vulnerability in Ipack Automation Systems Ipack SCADA Software allows : Blind SQL Injection.This issue affects Ipack SCADA Software: from unspecified before 1.1.0...

CVE-2020-36493

DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting XSS vulnerabilities in the component mediamain.php via the activepath, keyword, tag, fmdo=x&filename, CKEditor and CKEditorFuncNum parameters...

SUSE-SU-2021:0886-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2021-23336: Fixed a potential web cache poisoning by using a semicolon in query parameters use of semicolon as a query string separator bsc1182379...

CVE-2018-15811

DNN aka DotNetNuke 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters...

CVE-2018-18547

Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/directory/ dira parameter, or the filename to the list/directory/ URI...

iTech Gigs Script SQL Injection Vulnerability

iTech Gigs Script is an e-commerce website building system. The system features user registration, quotes and comments. A SQL injection vulnerability exists in iTech Gigs Script version 1.21. A remote attacker can inject SQL commands by sending the 'sc' parameter to the browse-scategory.php file ...

Code Execution Vulnerability in FineCMS Frontend name and params Parameters

FineCMS is a content management system based on PHP+MySql. A code execution vulnerability exists in the name and params parameters in the frontend of FineCMS version 5.0.6, which allows remote attackers to execute arbitrary code without logging in...

Reflective Cross-site Scripting Vulnerability in Multiple Parameters of SMi CMS School Website Management System

SMiCMS School Website Management System is a content management system for schools. A reflective cross-site scripting vulnerability exists in a number of parameters in the State Micro CMS University Edition, due to a failure to filter user-submitted parameters. These parameters include: module,...

qdPM Cross-Site Scripting Vulnerability

qdPM is a free , open source based on Symfony framework using PHP and MySQL development project management system . A cross-site scripting vulnerability exists in qdPM version 8.3. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of parameters ...

CVE-2011-5073

Multiple cross-site scripting XSS vulnerabilities in Support Incident Tracker aka SiT! before 3.65 allow remote attackers to inject arbitrary web script or HTML via the 1 mode parameter to contactsupport.php; 2 contractid parameter to contractaddservice.php; 3 user parameter to editbackupusers.ph...