1371 matches found
VulnCheck KEV: CVE-2024-2194
The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL search parameter in all versions up to, and including, 14.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2024-5407
A vulnerability in RhinOS 3.0-1190 could allow PHP code injection through the "search" parameter in /portal/search.htm. This vulnerability could allow a remote attacker to perform a reverse shell on the remote system, compromising the entire infrastructure...
CVE-2024-5408
Vulnerability in RhinOS 3.0-1190 consisting of an XSS through the "search" parameter of /portal/search.htm. This vulnerability could allow a remote attacker to steal details of a victim's user session by submitting a specially crafted URL...
CVE-2024-5408
CVE-2024-5408: A cross-site scripting vulnerability affects RhinOS 3.0-1190, exploitable via the search parameter of /portal/search.htm. A remote attacker could potentially steal a victim’s session details by crafting a URL. The available documents confirm the affected component and endpoint, and...
CVE-2024-5407: Improper Control of Generation of Code
A vulnerability in RhinOS 3.0-1190 could allow PHP code injection through the "search" parameter in /portal/search.htm. This vulnerability could allow a remote attacker to perform a reverse shell on the remote system, compromising the entire infrastructure...
CVE-2024-5408: Improper Neutralization of Input During Web Page Generation
Vulnerability in RhinOS 3.0-1190 consisting of an XSS through the "search" parameter of /portal/search.htm. This vulnerability could allow a remote attacker to steal details of a victim's user session by submitting a specially crafted URL...
PT-2024-36021 · Rhinos · Rhinos
Name of the Vulnerable Software and Affected Versions: RhinOS versions 3.0-1190 Description: A vulnerability could allow PHP code injection through the "search" parameter in /portal/search.htm, enabling a remote attacker to perform a reverse shell on the remote system and compromise the entire...
PT-2024-25123 · Roothub · Roothub
Name of the Vulnerable Software and Affected Versions: Roothub version 2.6 Description: A SQL injection issue was discovered in Roothub via the s parameter in the search function. This allows for potential exploitation. No information is provided about the estimated number of potentially affected...
Roothub 安全漏洞
Roothub is a forum system developed using SSM and MySQL. A security vulnerability exists in Roothub v2.6, which was discovered to contain an SQL injection vulnerability via the "s" parameter in the search function...
CVE-2024-3681: Improper Neutralization of Input During Web Page Generation
The Interactive World Maps plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search s parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
PT-2024-27165 · WordPress · Interactive World Maps
Name of the Vulnerable Software and Affected Versions: Interactive World Maps plugin for WordPress versions up to, and including, 2.4.14 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated...
CVE-2024-1789: Undefined Security Weakness
The WP SMTP plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in versions 1.2 to 1.2.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with...
Online Furniture Shopping Ecommerce Website SQL注入漏洞
Kashipara Online Furniture Shopping Ecommerce Website is a fast online shopping ecommerce website from Kashipara. A SQL injection vulnerability exists in the Online Furniture Shopping Ecommerce Website, which is caused by a SQL injection vulnerability in the txtSearch parameter of the search.php...
CVE-2024-2833
The Jobs for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘job-search’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...
WordPress Plugin Jobs for WordPress 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2024-22394 · WordPress · Jobs For Wordpress
Name of the Vulnerable Software and Affected Versions: Jobs for WordPress plugin for WordPress versions up to, and including, 2.7.5 Description: The issue is related to Reflected Cross-Site Scripting via the job-search parameter due to insufficient input sanitization and output escaping. This...
CVE-2024-31652
A cross-site scripting XSS in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter...
CVE-2024-31652
A cross-site scripting XSS in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter...
CVE-2024-31652
The Cosmetics and Beauty Product Online Store v1.0 is vulnerable to a cross-site scripting (XSS) flaw. Attackers can inject a crafted payload into the Search parameter to execute arbitrary web scripts or HTML. This vulnerability could allow attackers to steal user data or take control of user ses...
