16014 matches found
CVE-2019-19846
In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors...
CVE-2019-17418
An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=language=languagegeneral=doSearchParameter appno parameter, a different issue than CVE-2019-16997...
CVE-2018-17840
SQL injection exists in Scriptzee Education Website 1.0 via the collegelist.html subject, city, or country parameter...
CVE-2019-14792
The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectanglename or rectangleopacity parameter...
CVE-2018-17374
SQL Injection exists in the Auction Factory 4.5.5 component for Joomla! via the filterorderDir or filterorder parameter...
CVE-2019-0380
Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values to be part of the application logs leading to Information Disclosure...
CVE-2018-11649
Hue 3.12 has XSS via the /pig/save/ name and script parameters...
CVE-2018-20140
Zenphoto 1.4.14 has multiple cross-site scripting XSS vulnerabilities via different URL parameters...
CVE-2019-13076
Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticketlist.php, and affected parameters are order0column and order0dir...
CVE-2017-18004
Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint...
CVE-2018-14478
ecard.php in Coppermine Photo Gallery CPG 1.5.46 has XSS via the sendername, recipientemail, greetings, or recipientname parameter...
CVE-2019-19491
TestLink 1.9.19 has XSS via the lib/testcases/archiveData.php edit parameter, the index.php reqURI parameter, or the URI in a lib/testcases/tcEdit.php?doAction=doDeleteStep request...
CVE-2017-12788
Multiple cross-site scripting XSS vulnerabilities in admin/index.php in Metinfo 5.3.18 allows remote attackers to inject arbitrary web script or HTML via the 1 class1 parameter or the 2 anyid parameter...
CVE-2017-8854
wolfSSL before 3.10.2 has an out-of-bounds memory access with loading crafted DH parameters, aka a buffer overflow triggered by a malformed temporary DH file...
CVE-2017-1000488
Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form...
CVE-2017-17829
Bus Booking Script has SQL Injection via the admin/viewseatseller.php spid parameter or the admin/viewmember.php memid parameter...
CVE-2018-1000650
LibreHealthIO lh-ehr version REL-2.0.0 contains a SQL Injection vulnerability in Show Groups Popup SQL query functions that can result in Ability to perform malicious database queries. This attack appear to be exploitable via User controlled parameters...
CVE-2017-9435
Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php searchsupervisor and searchstatut parameters...
CVE-2012-1470
Multiple cross-site scripting XSS vulnerabilities in codeeditor.php in ocPortal before 7.1.6 allow remote attackers to inject arbitrary web script or HTML via the 1 path or 2 line parameters...