CVE-2018-20627: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Consumer Reviews Script 4.0.3 has HTML injection via the search box...

CVE-2018-17420

An issue was discovered in ZrLog 2.0.3. There is a SQL injection vulnerability in the article management search box via the keywords parameter...

CVE-2018-17420: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in ZrLog 2.0.3. There is a SQL injection vulnerability in the article management search box via the keywords parameter...

Khan Academy: POST XSS in https://www.khanacademy.org.tr/ via page_search_query parameter

Hey there, while testing your program I came across a XSS vulnerability in the search area of your website. The vector uses HTTP POST request and the parameter is "pagesearchquery"" on www.khanacademy.org.tr/arama.asp In the next topics I will demonstrate how you can reproduce the vulnerability...

U.S. Dept Of Defense: sql injection on /messagecenter/messagingcenter at https://www.███████/

Hi , i would like to report an issues that lead to SQL injection in search box at https://www.████/messagecenter/messagingcenter , if you add the character ' that usually used to test if the site have in sql injection the site will return with Incorrect syntax error that can confirm the site is...

CVE-2018-10076

An issue was discovered in Zoho ManageEngine EventLog Analyzer 11.12. A Cross-Site Scripting vulnerability allows a remote attacker to inject arbitrary web script or HTML via the search functionality the search box of the Dashboard...

PT-2018-9661

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine EventLog Analyzer version 11.12 Description: A Cross-Site Scripting issue allows a remote attacker to inject arbitrary web script or HTML via the search functionality, specifically the search box of the Dashboard...

PT-2018-7135

Name of the Vulnerable Software and Affected Versions: Jenkins versions prior to 2.44 Jenkins version 2.32.2 Description: The issue concerns an information disclosure vulnerability in search suggestions. The autocomplete feature on the search box discloses the names of the views in its suggestion...

Server side request forgery (ssrf)

EasyCMS 1.3 has XSS via the s POST parameter aka a search box value in an index.php?s=/index/search/index.html request...

CVE-2018-10374

EasyCMS 1.3 has XSS via the s POST parameter aka a search box value in an index.php?s=/index/search/index.html request...

CVE-2018-10374

EasyCMS 1.3 has XSS via the s POST parameter aka a search box value in an index.php?s=/index/search/index.html request...

CVE-2018-10374

EasyCMS 1.3 is affected by a Cross‑Site Scripting (XSS) vulnerability in the s POST parameter (the value of the search box) sent to index.php?s=/index/search/index.html. The issue arises from XSS in that parameter, enabling injection of arbitrary script/HTML. This CVE entry corresponds to EasyCMS...

PT-2018-9856

Name of the Vulnerable Software and Affected Versions: EasyCMS version 1.3 Description: The issue allows for XSS via the s POST parameter in an "index.php?s=/index/search/index.html" request. This is related to a search box value. Recommendations: For EasyCMS version 1.3, consider restricting the...

Code injection

dsmall v20180320 allows XSS via the member search box at the public/index.php/home/membersnsfriend/findlist.html URI...

CVE-2018-9015

dsmall v20180320 allows XSS via the public/index.php/home/predeposit/index.html pdrsn parameter aka the CMS search box...

CVE-2018-9017

dsmall v20180320 allows XSS via the member search box at the public/index.php/home/membersnsfriend/findlist.html URI...

CVE-2018-9015

dsmall v20180320 allows XSS via the public/index.php/home/predeposit/index.html pdrsn parameter aka the CMS search box...

CVE-2018-9017

dsmall v20180320 allows XSS via the member search box at the public/index.php/home/membersnsfriend/findlist.html URI...

CVE-2018-9015

dsmall v20180320 allows XSS via the public/index.php/home/predeposit/index.html pdrsn parameter aka the CMS search box...

CVE-2018-9015

CVE-2018-9015 affects dsmall v20180320, with a cross-site scripting (XSS) vulnerability exploitable via the public/index.php/home/predeposit/index.html page’s pdr_sn parameter (the CMS search box). The issue stems from unsanitized input in the pdr_sn field, enabling injection of arbitrary web scr...