580 matches found
Cross site scripting
The kentoemailsubscriberajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sanitise, validate and escape the submitted subscribeemail and subscribename POST parameters, inserting them in the DB and then outputting them back in the Subscriber list...
Crime records Management System 1.0 - 'Multiple' SQL Injection (Authenticated)
Exploit Title: Crime records Management System 1.0 - 'Multiple' SQL Injection Authenticated Date: 17/08/2021 Exploit Author: Davide 't0rt3ll1n0' Taraschi Vendor Homepage: https://www.sourcecodester.com/users/osman-yahaya Software Link:...
PT-2021-16029
Name of the Vulnerable Software and Affected Versions Astra Pro Addon WordPress plugin versions prior to 3.5.2 Description The issue arises from the improper sanitization or escaping of certain POST parameters from the astra pagination infinite and astra shop pagination infinite AJAX actions, whi...
CVE-2021-24507: Improper Neutralization of Special Elements used in an SQL Command
The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astrapaginationinfinite and astrashoppaginationinfinite AJAX action available to both unauthenticated and authenticated user before using them in SQL statement, leading to an...
Design/Logic Flaw
Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the "interface", "ssid" and "wpapassphrase" POST parameters in /hostapd, when the parameter values contain special characters such as ";" or "$" which enables an authenticated attacker to execute arbitrary OS commands...
CVE-2021-33358
RaspAP versions 2.3–2.6.5 contain command-injection vulnerabilities in the /hostapd endpoint via the interface, ssid, and wpa_passphrase POST parameters. Values containing special characters such as ; or $() may allow an authenticated attacker to execute arbitrary OS commands. Affects RaspAP’s we...
WordPress FlightLo plugin SQL Injection Vulnerability
WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an application plugin for WordPress. A SQL injection vulnerability exists in WordPress FlightLo plug...
CVE-2021-24336
The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement, leading to SQL injections exploitable by editor and administrator users...
CVE-2021-24336: Improper Neutralization of Special Elements used in an SQL Command
The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement, leading to SQL injections exploitable by editor and administrator users...
WordPress 插件 SQL注入漏洞
WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an application plugin for WordPress. A SQL injection vulnerability exists in WordPress FlightLo plug...
openSUSE Security Update : python-django-registration (openSUSE-2021-588)
This update for python-django-registration fixes the following issues : Update to 3.1.2 boo1184427, CVE-2021-21416 - Filter sensitive POST parameters in error reports - Fix RemovedInDjango40Warning from Signal arguments %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...
OPENSUSE-SU-2021:0597-1 Security update for python-django-registration
This update for python-django-registration fixes the following issues: Update to 3.1.2 boo1184427, CVE-2021-21416 Filter sensitive POST parameters in error reports Fix RemovedInDjango40Warning from Signal arguments This update was imported from the openSUSE:Leap:15.2:Update update project...
Security update for python-django-registration (moderate)
openSUSE Security Update: Security update for python-django-registration Announcement ID: openSUSE-SU-2021:0588-1 Rating: moderate References: 1184427 Cross-References: CVE-2021-21416 Affected Products: openSUSE Leap 15.2 An update that fixes one vulnerability is now available. Description: This...
GHSA-58C7-PX5V-82HH Potential sensitive information disclosed in error reports
django-registration is a user-registration application for Django. Impact The django-registration package provides tools for implementing user-account registration flows in the Django web framework. In django-registration prior to 3.1.2, the base user-account registration view did not properly...
PT-2021-14491
Name of the Vulnerable Software and Affected Versions django-registration versions prior to 3.1.2 Description The django-registration package has an issue where the base user-account registration view does not properly apply filters to sensitive data. This can result in sensitive data being...
ExpressionEngine 6.0.2 PHP Code Injection Vulnerability
---------------------------------------------------------------------------- ExpressionEngine security-sanitizefilename$file; 366. 367. $destdir = $this-languagesdir . $language . '/'; 368. $filename = $file . 'lang.php'; 369. $destloc = $destdir . $filename; 370. 371. $str = 'lang-loadfile$file;...
CVE-2020-26051
College Management System Php 1.0 suffers from SQL injection vulnerabilities in the index.php page from POST parameters 'unametxt' and 'pwdtxt', which are not filtered before passing a SQL query...
Sql injection
College Management System Php 1.0 suffers from SQL injection vulnerabilities in the index.php page from POST parameters 'unametxt' and 'pwdtxt', which are not filtered before passing a SQL query...
