CVE-2015-1363

Cross-site scripting XSS vulnerability in Free Reprintables ArticleFR 3.0.5 allows remote attackers to inject arbitrary web script or HTML via the q parameter to search/v/...

CVE-2015-1363: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Free Reprintables ArticleFR 3.0.5 allows remote attackers to inject arbitrary web script or HTML via the q parameter to search/v/...

CVE-2015-1365: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to write to arbitrary files via a .. dot dot in the q parameter...

PT-2015-5238

Name of the Vulnerable Software and Affected Versions Free Reprintables ArticleFR version 3.0.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the q parameter to the "search/v/" API endpoint. Recommendations For version 3.0.5, avoid...

PT-2015-5240

Name of the Vulnerable Software and Affected Versions Pixabay Images plugin versions prior to 2.4 Description The issue allows remote attackers to write to arbitrary files via a .. dot dot in the q parameter. This is a directory traversal vulnerability in the pixabay-images.php file...

CVE-2014-9442

SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the q parameter in a promotionProductSearch action to wp-admin/admin-ajax.php...

CVE-2014-9442: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the q parameter in a promotionProductSearch action to wp-admin/admin-ajax.php...

CVE-2011-5312

Multiple cross-site scripting XSS vulnerabilities in Gollos 2.8 allow remote attackers to inject arbitrary web script or HTML via the returnurl parameter to 1 register.aspx, 2 publication/info.aspx, or 3 user/add.aspx, or 4 the q parameter to product/list.aspx...

CVE-2014-8682

Multiple SQL injection vulnerabilities in Gogs aka Go Git Service 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to 1 api/v1/repos/search, which is not properly handled in models/repo.go, or 2 api/v1/users/search, which is...

PT-2014-8682 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: Gogs versions 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta Description: The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the q parameter to two API endpoints: "api/v1/repos/search" and...

CVE-2014-8682: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Gogs aka Go Git Service 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to 1 api/v1/repos/search, which is not properly handled in models/repo.go, or 2 api/v1/users/search, which is...

CVE-2013-7334: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in ImageCMS before 4.2 allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the q parameter, related to CVE-2012-6290...

CVE-2012-6290: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ImageCMS before 4.2 allows remote authenticated administrators to execute arbitrary SQL commands via the q parameter to admin/adminsearch/. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands...

PT-2014-2380

Name of the Vulnerable Software and Affected Versions ImageCMS versions prior to 4.2 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands via the q parameter to the "admin/admin search/" endpoint. This can be leveraged using CSRF to allow remote...

PT-2014-3372

Name of the Vulnerable Software and Affected Versions ImageCMS versions prior to 4.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the q parameter. Recommendations For...

Cory Support "q" SQL注入漏洞

Cory Support是一款PHP应用。 由于通过"q" GET参数传递到loadsolve.php的输入在被用于SQL查询前未能正确过滤，攻击者可以利用漏洞通过注入任意SQL代码操纵SQL查询。 0 Cory Support 1.0 目前厂商暂无提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://coryapp.com/page.php?id=1 // GET MySQL Injection with "q" Parameter in /loadsolve.php 1 : ?php 2 :...

CVE-2012-6630: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Media Library Categories plugin 1.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 bulk parameter to media-library-categories/add.php or 2 q parameter to media-library-categories/view.php...

PT-2013-1980

Name of the Vulnerable Software and Affected Versions PHP Ticket System Beta 1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the q parameter to the "index.php" endpoint. Recommendations For PHP Ticket System Beta 1, consider restricting acce...

CVE-2012-6516: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in PHP Ticket System Beta 1 allows remote attackers to execute arbitrary SQL commands via the q parameter to index.php...

CVE-2012-4489

Open redirect vulnerability in the secureloginsecureredirect function in the Secure Login module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter...