232 matches found
Sql injection
E-Sic 1.0 allows SQL injection via the q parameter to esiclivre/restrito/inc/lkpcep.php aka the search private area...
CVE-2017-15373
CVE-2017-15373 : E-Sic 1.0 contains a SQL injection in the query parameter “q” of esiclivre/restrito/inc/lkpcep.php (the search private area). The root cause is improper handling of input leading to arbitrary SQL execution. Impact is described as partial to high confidentiality, integrity, and av...
CVE-2017-12798
Cross-Site Scripting XSS exists in NexusPHP version v1.5 via the q parameter to searchsuggest.php...
PaulShop 'q' Parameter SQL Injection Vulnerability
PaulShop is a shopping cart web system. A SQL injection vulnerability exists in the PaulShop 'q' parameter. This allows attackers to exploit the vulnerability to obtain sensitive information...
SQL Injection
github.com/gogits/gogs is vulnerable to SQL injection attacks. These attacks are possible because the q parameter is not correctly handled...
DotCMS SQL Injection Vulnerability (CNVD-2017-01933)
DotCMS is a content management system CMS from the American company DotCMS. The system supports RSS feeds , blogs , forums and other modules , and is easy to extend and build . A SQL injection vulnerability exists in categoriesServlet in DotCMS versions prior to 3.6.1. A remote attacker can explo...
countyoffice.org XSS vulnerability
Vulnerable URL: http://www.countyoffice.org/?q="+alert'O+\nP+\nE\nN+\nB\nU+\nG\nB+\nO\nU+\nN\nT+\nY';...
Chaudic Cross-Site Scripting Vulnerability
Chaudic is a professional retail management software. A cross-site scripting vulnerability exists in the q parameter of the search page in Chaordic version 1.1, which stems from the program failing to adequately filter user-submitted input. An attacker could use this vulnerability to steal...
Diasite CMS Cross-Site Scripting Vulnerability
Diasite CMS is a web management tool that provides multiple services. Cross-site scripting vulnerabilities exist in the q parameter of the Rechercher-14-0-0-0.html page of Diasite CMS that stem from the program failing to adequately filter user-submitted input. An attacker could exploit these...
ImageMagick Arbitrary Process Data Read Vulnerability
ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. There is a security vulnerability in ImageMagick. An attacker can exploit this vulnerability to read arbitrary process...
Parsijoo Cross Site Scripting
================================================================================ Cross Site Scripting on Search Engine Parsijoo ================================================================================ Author: bl4ckmohajem [email protected] home page : http://www.parsijoo.ir/...
Vulnerability in OpenSSL - DH small subgroups
Historically OpenSSL usually only ever generated DH parameters based on “safe” primes. More recently in version 1.0.2 support was provided for generating X9.42 style parameter files such as those required for RFC 5114 support. The primes used in such files may not be “safe”. Where an application ...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Ultimate PHP Board aka myUPB before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the 1 q parameter to search.php or 2 avatar parameter to profile.php...
WordPress Plugin Pixabay Images Directory Traversal Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites set up on PHP and MySQL servers.Pixabay Images is one of the support for selecting photos from Pixabay image material sharing network in the CC0...
Cross site scripting
Cross-site scripting XSS vulnerability in Free Reprintables ArticleFR 3.0.5 allows remote attackers to inject arbitrary web script or HTML via the q parameter to search/v/...
CVE-2015-1363
Cross-site scripting XSS vulnerability in Free Reprintables ArticleFR 3.0.5 allows remote attackers to inject arbitrary web script or HTML via the q parameter to search/v/...
CVE-2011-5312
Multiple cross-site scripting XSS vulnerabilities in Gollos 2.8 allow remote attackers to inject arbitrary web script or HTML via the returnurl parameter to 1 register.aspx, 2 publication/info.aspx, or 3 user/add.aspx, or 4 the q parameter to product/list.aspx...
PT-2014-8682 · Gogs · Gogs
Name of the Vulnerable Software and Affected Versions: Gogs versions 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the q parameter to two API endpoints: "api/v1/repos/search" and...
Cory Support "q" SQL注入漏洞
Cory Support是一款PHP应用。 由于通过"q" GET参数传递到loadsolve.php的输入在被用于SQL查询前未能正确过滤，攻击者可以利用漏洞通过注入任意SQL代码操纵SQL查询。 0 Cory Support 1.0 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://coryapp.com/page.php?id=1 // GET MySQL Injection with "q" Parameter in /loadsolve.php 1 : ?php 2 :...
