32 matches found
CVE-2023-29154
SQL injection vulnerability exists in the CONPROSYS HMI System CHS versions prior to 3.5.3. A user who can access the affected product with an administrative privilege may execute an arbitrary SQL command via specially crafted input to the query setting page...
PT-2023-22173 · Unknown · Conprosys Hmi System
Name of the Vulnerable Software and Affected Versions: CONPROSYS HMI System CHS versions prior to 3.5.3 Description: A SQL injection issue exists, allowing a user with administrative privileges to execute arbitrary SQL commands by providing specially crafted input to the query setting page...
CVE-2021-32664
Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5...
CVE-2021-32664
CVE-2021-32664 (Combodo iTop) is an XSS vulnerability on the run query page when authenticated as administrator. The primary description notes affected versions and fixes: it was resolved in iTop versions 2.6.5 and 2.7.5. Connected sources corroborate iTop-specific issues and mitigations across m...
CVE-2021-32664: Improper Neutralization of Input During Web Page Generation
Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on "run query" page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5...
PT-2021-19842 · Comodo +1 · Itop +1
Name of the Vulnerable Software and Affected Versions: Combodo iTop versions prior to 2.6.5 Combodo iTop versions prior to 2.7.5 Description: The issue is related to a XSS vulnerability on the "run query" page when logged in as an administrator. This vulnerability has been resolved in versions...
SQL Injection Vulnerability in Supplier Inquiry System Co***.aspx Page
Shanghai Haidian Software Co., Ltd. is a provider of informatization solutions focusing on the pharmaceutical distribution industry. A SQL injection vulnerability exists in the Co.aspx page of the supplier query system, which can be exploited by an attacker to obtain sensitive information from th...
CVE-2019-17072
The new-contact-form-widget aka Contact Form Widget - Contact Query, Form Maker plugin 1.0.9 for WordPress has SQL Injection via all-query-page.php...
CVE-2017-12630
In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...
CVE-2017-12630
In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...
CVE-2017-12630: Improper Neutralization of Input During Web Page Generation
In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this...