PT-2017-14956

Name of the Vulnerable Software and Affected Versions Techno - Portfolio Management Panel versions prior to 2017-11-16 Description The issue allows full path disclosure via an invalid s parameter to the "panel/search.php" endpoint. Recommendations For versions prior to 2017-11-16, consider...

PT-2017-14955

Name of the Vulnerable Software and Affected Versions Techno - Portfolio Management Panel versions prior to 2017-11-16 Description The issue allows SQL Injection via the panel/search.php endpoint, specifically through the s parameter. Recommendations For versions prior to 2017-11-16, update to a...

CVE-2017-17695: Improper Neutralization of Special Elements used in an SQL Command

Techno - Portfolio Management Panel through 2017-11-16 allows SQL Injection via the panel/search.php s parameter...

CVE-2017-17694: Improper Neutralization of Input During Web Page Generation

Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter...

CVE-2017-17696: Exposure of Sensitive Information to an Unauthorized Actor

Techno - Portfolio Management Panel through 2017-11-16 allows full path disclosure via an invalid s parameter to panel/search.php...

Creative Management System Lite SQL Injection Vulnerability

Creative Management System CMS Lite is a web content management system with features such as menu design, site backup and site calendar. A SQL injection vulnerability exists in CMS Lite version 1.4. A remote attacker can exploit the vulnerability by sending the 'S' parameter to the index.php file...

Sql injection

Creative Management System CMS Lite 1.4 allows SQL Injection via the S parameter to index.php...

PT-2017-14339

Name of the Vulnerable Software and Affected Versions Creative Management System CMS Lite version 1.4 Description The issue allows SQL Injection via the S parameter to the "index.php" endpoint. Recommendations For Creative Management System CMS Lite version 1.4, consider restricting access to the...

CVE-2017-15984: Improper Neutralization of Special Elements used in an SQL Command

Creative Management System CMS Lite 1.4 allows SQL Injection via the S parameter to index.php...

PT-2017-6863

Name of the Vulnerable Software and Affected Versions Paid Memberships Pro plugin versions prior to 1.8.4.3 for WordPress Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the s parameter to "membershiplevels.php", "memberslist.php", or...

Gxlcms Arbitrary File Read Vulnerability

Gxlcms is an enterprise website creation system. A security vulnerability exists in Gxlcms that originates from the program using an insecure method to restrict access. The vulnerability can be exploited by a remote attacker to read arbitrary files by sending an 's' parameter with a changed...

CVE-2017-14979: Undefined Security Weakness

Gxlcms uses an unsafe character-replacement approach in an attempt to restrict access, which allows remote attackers to read arbitrary files via modified pathnames in the s parameter to index.php, related to Lib/Admin/Action/TplAction.class.php and Lib/Admin/Common/function.php...

PT-2017-13798

Name of the Vulnerable Software and Affected Versions Gxlcms affected versions not specified Description The issue allows remote attackers to read arbitrary files via modified pathnames in the s parameter to "index.php". This is related to Lib/Admin/Action/TplAction.class.php and...

Schneider Electric U.motion Builder runscript directory traversal vulnerability

U.motion Builder is a builder product from Schneider Electric France. A directory traversal vulnerability exists in the Schneider Electric U.motion Builder runscript. When handling the 's' parameter of a small application. An attacker could exploit the vulnerability to expose files from the syste...

perrehaber.com XSS vulnerability

Vulnerable URL: https://www.perrehaber.com/?s="/alert/OPENBUGBOUNTY/...

Sweepstakes Pro Software SQL Injection Vulnerability

Sweepstakes Pro Software is a suite of sweepstakes software to increase email lists, increase social networking, and drive sales by running sweepstakes software in conjunction with sweepstakes. A SQL injection vulnerability exists in the s parameter in both win.php and widgetlb.php in Sweepstakes...

PT-2017-17683

Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows for an XSS attack through the admin/index.php endpoint with specific settings. The attack is facilitated by the s and x parameters. Recommendations For Pixie version 1.0.4, as a temporary...

antenova-m2m.com XSS vulnerability

Vulnerable URL: http://www.antenova-m2m.com/?s=1'%22%26%25prompt/OPENBUGBOUNTY/...

CVE-2014-100018

Cross-site scripting XSS vulnerability in the Unconfirmed plugin before 1.2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in the unconfirmed page to wp-admin/network/users.php...

PT-2015-3624

Name of the Vulnerable Software and Affected Versions WordPress Unconfirmed plugin versions prior to 1.2.5 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the s parameter in the unconfirmed page to "wp-admin/network/users.php"...