CVE-2023-34598

Gibbon v25.0.0 - Local File Inclusion - CVE-2023-34598 Gibbon v25.0.0은 로컬 파일 포함LFI 취약점에 취약하며, 서버 응답에 설치 폴더에 있는 여러 파일의 내용을 포함시킬 수 있습니다. Proof of Concept 취약점을 악용하기 위해 공격자는 "q" 파라미터를 조작하여 로컬 파일을 쿼리해야 합니다. 이 조작으로 인해 파일이 서버 응답에 포함됩니다. 그러나 이 익스플로잇은 설치 폴더 내에 있는 파일과 특정 조건예: PHP 파일 제외에서만 유효합니다...

CVE-2024-27956-RCE

CVE-2024-27956-RCE Ein PoC für CVE-2024-27956, eine SQL-Injection im ValvePress Automatic Plugin. Dieser PoC nutzt die Schwachstelle aus, indem er einen Benutzer auf dem Zielsystem erstellt und diesem Administratorrechte verleiht. Als Administrator in WordPress kann man Remote Code Execution...

CVE-2025-28121

💥 CVE-2025-28121 - XSS Riflesso in Online Exam Mastering System 1.0 📝 Descrizione code-projects Online Exam Mastering System 1.0 è vulnerabile a Cross-Site Scripting XSS Riflesso nel file feedback.php tramite il parametro q. Questo problema consente a un attaccante remoto di iniettare JavaScript...

CVE-2020-18324

Subrion CMS 4.2.1 – Vulnerabilità XSS riflessa nel template Kickstart Descrizione Subrion CMS è facile da installare e semplice da gestire. Utilizzalo come applicazione autonoma o in combinazione con altre applicazioni per creare siti di livello base, siti di medie o grandi dimensioni. La...

CVE-2023-45542

CVE-2023-45542 In mooSocial v3.1.8 existiert eine reflektierte Cross-Site-Scripting XSS-Schwachstelle im Parameter q der Suchfunktion, die es Angreifern ermöglicht, die Session-Cookies des Benutzers zu stehlen und sein Konto über eine manipulierte URL zu übernehmen. Verwundbarer Parameter: q...

CVE-2026-73295

Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest...

CVE-2026-73295

Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest...

py-mkdocs-material -- DOM XSS vulnerability

Martin Donath reports: Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction...

CVE-2026-11772

DRIMO CMS is affected by a Reflected XSS in the searching functionality, triggered via the q parameter. The vulnerability allows arbitrary JavaScript execution in the victim’s browser when a crafted URL is opened. The affected software is at end-of-life and no security updates are planned. Mitiga...

CVE-2018-25413

AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'q' parameter. Attackers can send GET requests to search.php with crafted SQL payloads to extract sensitive database informati...

CVE-2018-25413

AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'q' parameter. Attackers can send GET requests to search.php with crafted SQL payloads to extract sensitive database informati...

CVE-2018-25413 AiOPMSD Final 1.0.0 SQL Injection via search.php

AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'q' parameter. Attackers can send GET requests to search.php with crafted SQL payloads to extract sensitive database informati...

CVE-2018-25413

AiOPMSD Final 1.0.0 is affected by an SQL injection in search.php via the q parameter, allowing unauthenticated attackers to execute arbitrary SQL and enumerate usernames, database names, and version details. The CVE entry includes CVSS scores (3.1: base 8.2 HIGH network/low integrity; 4.0: base ...

PT-2026-45113

Name of the Vulnerable Software and Affected Versions AiOPMSD Final version 1.0.0 Description An SQL injection allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code. This is achieved by sending GET requests to the 'search.php' endpoint using the q parameter...

CVE-2026-34400

Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API q= was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version...

GHSA-8PRR-286P-4W7J alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API

Impact The Query string search API q= was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. Patches Fixed in v9.1.0. The Postgres query parser now uses parameterized queries wit...

SQL Injection

Overview alerta-server is an Alerta server WSGI application Affected versions of this package are vulnerable to SQL Injection in the q parameter of the query string API due to direct interpolation of user-supplied input into SQL statements using f-strings. An attacker can execute arbitrary SQL...

CVE-2019-25513

Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'q' parameter. Attackers can send GET requests to datagetir.php with malicious 'q' values using time-based blind...

CVE-2019-25513 Jettweb PHP Hazir Haber Sitesi Scripti V3 SQL Injection via datagetir.php

Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'q' parameter. Attackers can send GET requests to datagetir.php with malicious 'q' values using time-based blind...

Jettweb PHP Hazir Haber Sitesi Scripti SQL注入漏洞

Jettweb PHP Preconfigured News Sites Script is a content management system developed by the Turkish company Jettweb. The Jettweb PHP Preconfigured News Sites Script V3 version has a SQL injection vulnerability. This vulnerability stems from the q parameter, which allows for SQL injections. It cou...