PESCMS cross-site scripting vulnerability

A cross-site scripting vulnerability exists in PESCMS version V2.3.3, a content publishing platform. The vulnerability stems from App/Team/GET/Report.php missing a data validation filter for user-supplied data and output. An attacker could exploit the vulnerability to execute JavaScript code on t...

PT-2022-20996

Name of the Vulnerable Software and Affected Versions Rescue Dispatch Management System version 1.0 Description The issue concerns SQL Injection vulnerability. It can be exploited via the /rdms/admin/incident reports/view report.php endpoint, specifically through the id parameter. Recommendations...

PT-2022-20997

Name of the Vulnerable Software and Affected Versions Rescue Dispatch Management System version 1.0 Description The issue concerns SQL Injection. It can be exploited via the "/rdms/admin/incident reports/manage report.php" API endpoint, specifically through the id variable. Recommendations For...

PT-2022-20147

Name of the Vulnerable Software and Affected Versions School Dormitory Management System version 1.0 Description The issue concerns SQL Injection, which can be exploited via the "reports/daily collection report.php" endpoint. Specifically, the vulnerability is located at line 59 of this file...

PT-2022-20364

Name of the Vulnerable Software and Affected Versions School Dormitory Management System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the month parameter at the "/dms/admin/reports/daily collection report.php" API endpoint...

Cross-site Scripting (XSS)

moodle/moodle is vulnerable to stored cross-site scripting. The vulnerability exists in getquestionheading function in report.php due to lack of sanitization which allows an attacker to inject and execute arbitrary javascript...

CVE-2021-30034

Cross Site Scripting XSS in Remote Clinic v2.0 via the Symptons field on patients/register-report.php...

CVE-2021-30034

Cross Site Scripting XSS in Remote Clinic v2.0 via the Symptons field on patients/register-report.php...

CVE-2021-30039

Cross Site Scripting XSS in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-report.php...

CVE-2021-30039

CVE-2021-30039 affects Remote Clinic v2.0. The vulnerability is a Cross-Site Scripting (XSS) flaw in the web form fields at patients/register-report.php, specifically the Fever and Blood Pressure fields. Root cause: inadequate input validation/sanitization allowing script injection that can execu...

CVE-2021-30039

Cross Site Scripting XSS in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-report.php...

CVE-2021-30034: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in Remote Clinic v2.0 via the Symptons field on patients/register-report.php...

PT-2021-18578

Name of the Vulnerable Software and Affected Versions Remote Clinic version 2.0 Description The issue is related to Cross Site Scripting XSS that occurs via the Symptons field on the "patients/register-report.php" API endpoint. This allows for potential malicious script execution. Recommendations...

CVE-2021-30039: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in Remote Clinic v2.0 via the "Fever" or "Blood Pressure" field on the patients/register-report.php...

PT-2021-18579

Name of the Vulnerable Software and Affected Versions Remote Clinic version 2.0 Description The issue is related to Cross Site Scripting XSS that can be exploited via the Fever or Blood Pressure field on the "patients/register-report.php" API endpoint. This allows for malicious script execution...

PT-2021-11645

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 5.0.2.5 Description: A SQL injection issue allows a remote authenticated attacker to execute arbitrary SQL commands. The issue is related to the form code parameter in the interface/reports/immunization report.php...

PT-2019-6863

Name of the Vulnerable Software and Affected Versions MantisBT version 1.2.13 Description A cross-site scripting XSS issue exists in the configuration report page, specifically in the adm config report.php file, allowing remote authenticated users to inject arbitrary web script or HTML via a...

CVE-2018-11133

The 'fmt' parameter of the '/common/runcrossreport.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to cross-site scripting...

PT-2018-10332

Name of the Vulnerable Software and Affected Versions Quest KACE System Management Appliance version 8.0.318 Description The issue concerns the '/common/run report.php' script, where the reportID parameter is not properly sanitized. This leads to a SQL injection vulnerability, specifically an...

PT-2018-10324

Name of the Vulnerable Software and Affected Versions Quest KACE System Management Appliance version 8.0.318 Description The issue concerns a cross-site scripting vulnerability in the '/common/run cross report.php' script. Specifically, the fmt parameter is vulnerable. Recommendations For Quest...