CVE-2018-7764: Improper Limitation of a Pathname to a Restricted Directory

The vulnerability exists within runscript.php applet in Schneider Electric U.motion Builder software versions prior to v1.3.4. There is a directory traversal vulnerability in the processing of the 's' parameter of the applet...

LFCMS Cross-Site Request Forgery Vulnerability

LFCMS is a PHP based on THINKPHP3.2.3 framework development, suitable for all kinds of video, film and television websites, film and television content management program. LFCMS 3.7.0 admin.php cross-site request forgery vulnerability exists. Remote attackers can use this vulnerability to hijack...

CVE-2018-12603

Cross-site request forgery CSRF vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecified users for requests that add administrator users via the s parameter, a related issue to CVE-2018-12114...

PT-2018-11284

Name of the Vulnerable Software and Affected Versions LFCMS version 3.7.0 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack the authentication of users for requests that add administrator users via the s parameter. Recommendations For LFCMS version...

CVE-2018-12603: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in admin.php in LFCMS 3.7.0 allows remote attackers to hijack the authentication of unspecified users for requests that add administrator users via the s parameter, a related issue to CVE-2018-12114...

CVE-2018-11568

Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter. In some but not all cases, the '' characters have and representations...

CVE-2018-11568: Improper Neutralization of Input During Web Page Generation

Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization, as demonstrated by the s parameter. In some but not all cases, the '' characters have representations...

PT-2018-10674

Name of the Vulnerable Software and Affected Versions GamePlan theme for WordPress versions prior to 1.5.13.2 Description The issue is related to insufficient input sanitization, allowing for Reflected XSS. This can be demonstrated through the s parameter. In some cases, the '' characters are...

PT-2018-9856

Name of the Vulnerable Software and Affected Versions: EasyCMS version 1.3 Description: The issue allows for XSS via the s POST parameter in an "index.php?s=/index/search/index.html" request. This is related to a search box value. Recommendations: For EasyCMS version 1.3, consider restricting the...

CVE-2018-10374: Improper Neutralization of Input During Web Page Generation

EasyCMS 1.3 has XSS via the s POST parameter aka a search box value in an index.php?s=/index/search/index.html request...

CVE-2018-10225

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

CVE-2018-10225: Improper Neutralization of Special Elements used in an SQL Command

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

PT-2018-9767

Name of the Vulnerable Software and Affected Versions: thinkphp version 3.1.3 Description: The issue is related to SQL Injection, which can be exploited via the s parameter in the "index.php" endpoint. Recommendations: For thinkphp version 3.1.3, update to a newer version that contains a fix for...

Schneider Electric U.motion Builder Directory Traversal Vulnerability

U.motion Builder is a generator product from Schneider Electric France. A directory traversal vulnerability exists in Schneider Electric U.motion Builder when handling the 's' parameter of an applet. The vulnerability exists in the runscript.php applet and can be exploited to obtain sensitive...

PT-2017-5039

Name of the Vulnerable Software and Affected Versions: bSuite plugin versions prior to 5 alpha 3 Description: The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the s or p parameters to...

CVE-2011-4955: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in uistats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 s or 2 p parameters to index.php...

Techno - Portfolio Management Panel SQL Injection Vulnerability

Techno - Portfolio Management Panel is a set of portfolio management panel scripts. A SQL injection vulnerability exists in Techno - Portfolio Management Panel 2017-11-16 and earlier versions. A remote attacker can exploit the vulnerability by sending the 's' parameter to the panel/search.php fil...

CVE-2017-17696

Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php...

CVE-2017-17696

Techno - Portfolio Management Panel is affected by an information disclosure vulnerability through an invalid s parameter to panel/search.php, enabling disclosure of sensitive paths. The CVE notes impact as a path disclosure; affected versions include 2017-11-16 and earlier. Connected sources (CN...

PT-2017-14954

Name of the Vulnerable Software and Affected Versions Techno - Portfolio Management Panel versions prior to 2017-11-16 Description The issue allows for XSS via the s parameter in the "panel/search.php" endpoint. Recommendations For versions prior to 2017-11-16, update to a version released after...