PT-2023-7010 · Phpipam · Phpipam

Name of the Vulnerable Software and Affected Versions: phpipam versions prior to 1.5.2 Description: The issue allows attackers to enumerate arbitrary fields in the LDAP server and access sensitive data via a crafted POST request. This is possible due to a LDAP injection vulnerability via the dnam...

SPA-Cart eCommerce CMS SQL注入漏洞

SPA-Cart eCommerce CMS is a CMS system from SPA-Cart. A SQL injection vulnerability exists in SPA-Cart eCommerce CMS version 1.9.0.3, which stems from the parameter filterbrandid in the file /search that can lead to sql injection...

PT-2023-29560 · Unknown · Spa-Cart Ecommerce Cms

Name of the Vulnerable Software and Affected Versions: SPA-Cart eCommerce CMS version 1.9.0.3 Description: A vulnerability was found in the SPA-Cart eCommerce CMS, affecting some unknown functionality of the file /search. The manipulation of the arguments filterbrandid and filterprice leads to...

PT-2023-29563 · Unknown · Spa-Cart Ecommerce Cms

Name of the Vulnerable Software and Affected Versions: SPA-Cart eCommerce CMS version 1.9.0.3 Description: A critical vulnerability has been found in the GET Parameter Handler component of the /search file. The manipulation of the filterbrandid argument leads to SQL injection. This issue can be...

qibosoft Cross-Site Scripting Vulnerability

Qibosoft qibosoft is a content management system CMS from the Chinese company Qibosoft. A cross-site scripting vulnerability exists in qibosoft v.7 and earlier versions that could allow a remote attacker to execute arbitrary code via the eindtijd and starttijd parameters of do/search.php...

PT-2023-26503 · Unknown · Phpscriptpoint Bloodbank

Name of the Vulnerable Software and Affected Versions: phpscriptpoint BloodBank version 1.1 Description: A critical vulnerability has been found in the software. The issue is related to an unknown function of the file /search of the component POST Parameter Handler. The manipulation of the countr...

PT-2023-26183 · Kubepi · Kubepi

Name of the Vulnerable Software and Affected Versions: KubePi versions prior to 1.6.5 Description: The issue concerns the leakage of password hashes for any user, including administrators, through the /kubepi/api/v1/users/search endpoint. This could allow a motivated attacker to crack the leaked...

PT-2023-25719 · Livelyworks · Livelyworks Articart

Name of the Vulnerable Software and Affected Versions: LivelyWorks Articart version 2.0.1 Description: A vulnerability has been found in LivelyWorks Articart, affecting an unknown functionality of the file "/items/search". The manipulation of the search term argument leads to cross-site scripting...

CVE-2023-32717

Summary: CVE-2023-32717 affects Splunk Enterprise and Splunk Cloud Platform. An unauthorized user can access the REST endpoint /services/indexing/preview to overwrite search results if they know the SID of an existing search job. The issue is rooted in RBAC/endpoint handling for that path. Affect...

PT-2023-24462 · Bluecms · Bluecms

Name of the Vulnerable Software and Affected Versions: BlueCMS version 1.6 Description: A SQL injection issue was found in BlueCMS via the keywords parameter at the "search.php" endpoint. Recommendations: For BlueCMS version 1.6, avoid using the keywords parameter in the "search.php" endpoint unt...

PT-2023-21852 · Unknown · Siteserver Cms

Name of the Vulnerable Software and Affected Versions: SiteServer CMS versions up to 7.2.1 Description: A problematic issue was found in the software, affecting an unknown function of the file /api/stl/actions/search. The manipulation of the ajaxDivId argument leads to cross-site scripting. It is...

PT-2022-27359 · Webtareas · Webtareas

Name of the Vulnerable Software and Affected Versions: webtareas version 2.4p5 Description: A cross-site scripting XSS issue was found in the /general/search.php?searchtype=simple component. This allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the...

grafana: IDOR vulnerability can lead to information disclosure

An Insecure Direct Object Reference IDOR vulnerability was found on Grafana Teams APIs. This flaw impacts the /teams/:teamId, /teams/:search, /teams/:teamId/members API endpoints and may allow an authenticated attacker to view unintended data by querying for the specific team ID or search for tea...

CVE-2021-35388

Hospital Management System v 4.0 is vulnerable to Cross Site Scripting XSS via /hospital/hms/admin/patient-search.php...

CVE-2022-37044

In Zimbra Collaboration Suite ZCS 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine...

PT-2022-23767 · Zimbra · Zimbra Collaboration Suite

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite versions 8.8.15 Description: The issue concerns a reflected XSS in the /h/search?action API endpoint, which accepts parameters called extra, title, and onload that are partially sanitized. This allows for the...

Denial Of Service (DOS)

Raneto is vulnerable to Denial of Service. The vulnerability is due to the GET search endpoint located at app/routes/search.route.js. An unauthenticated attacker can supply a malicious search query, crashing the program...

CVE-2022-23899

MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java...

PT-2021-23163 · Bookstack · Bookstack

Name of the Vulnerable Software and Affected Versions: BookStack versions prior to 21.11.3 Description: The issue allows a logged-in user with no privileges or a guest user if public access is enabled to access the "/search/users/select" AJAX endpoint, which is meant for admins to manage audit...

PT-2021-23562 · Unknown · Ifsc Code Finder Project

Name of the Vulnerable Software and Affected Versions: IFSC Code Finder Project version 1.0 Description: A SQL Injection issue exists via the searchifsccode POST parameter in the "/search.php" API endpoint. This allows for potential exploitation. No information is provided about the estimated...