qibosoft Cross-Site Scripting Vulnerability

Qibosoft qibosoft is a content management system CMS from the Chinese company Qibosoft. A cross-site scripting vulnerability exists in qibosoft v.7 and earlier versions that could allow a remote attacker to execute arbitrary code via the eindtijd and starttijd parameters of do/search.php...

PT-2023-26503 · Unknown · Phpscriptpoint Bloodbank

Name of the Vulnerable Software and Affected Versions: phpscriptpoint BloodBank version 1.1 Description: A critical vulnerability has been found in the software. The issue is related to an unknown function of the file /search of the component POST Parameter Handler. The manipulation of the countr...

PT-2023-26183 · Kubepi · Kubepi

Name of the Vulnerable Software and Affected Versions: KubePi versions prior to 1.6.5 Description: The issue concerns the leakage of password hashes for any user, including administrators, through the /kubepi/api/v1/users/search endpoint. This could allow a motivated attacker to crack the leaked...

PT-2023-25719 · Livelyworks · Livelyworks Articart

Name of the Vulnerable Software and Affected Versions: LivelyWorks Articart version 2.0.1 Description: A vulnerability has been found in LivelyWorks Articart, affecting an unknown functionality of the file "/items/search". The manipulation of the search term argument leads to cross-site scripting...

CVE-2023-32717

Summary: CVE-2023-32717 affects Splunk Enterprise and Splunk Cloud Platform. An unauthorized user can access the REST endpoint /services/indexing/preview to overwrite search results if they know the SID of an existing search job. The issue is rooted in RBAC/endpoint handling for that path. Affect...

PT-2023-24462 · Bluecms · Bluecms

Name of the Vulnerable Software and Affected Versions: BlueCMS version 1.6 Description: A SQL injection issue was found in BlueCMS via the keywords parameter at the "search.php" endpoint. Recommendations: For BlueCMS version 1.6, avoid using the keywords parameter in the "search.php" endpoint unt...

PT-2023-21852 · Unknown · Siteserver Cms

Name of the Vulnerable Software and Affected Versions: SiteServer CMS versions up to 7.2.1 Description: A problematic issue was found in the software, affecting an unknown function of the file /api/stl/actions/search. The manipulation of the ajaxDivId argument leads to cross-site scripting. It is...

PT-2022-27359 · Webtareas · Webtareas

Name of the Vulnerable Software and Affected Versions: webtareas version 2.4p5 Description: A cross-site scripting XSS issue was found in the /general/search.php?searchtype=simple component. This allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the...

grafana: IDOR vulnerability can lead to information disclosure

An Insecure Direct Object Reference IDOR vulnerability was found on Grafana Teams APIs. This flaw impacts the /teams/:teamId, /teams/:search, /teams/:teamId/members API endpoints and may allow an authenticated attacker to view unintended data by querying for the specific team ID or search for tea...

CVE-2021-35388

Hospital Management System v 4.0 is vulnerable to Cross Site Scripting XSS via /hospital/hms/admin/patient-search.php...

CVE-2022-37044

In Zimbra Collaboration Suite ZCS 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine...

PT-2022-23767 · Zimbra · Zimbra Collaboration Suite

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite versions 8.8.15 Description: The issue concerns a reflected XSS in the /h/search?action API endpoint, which accepts parameters called extra, title, and onload that are partially sanitized. This allows for the...

Denial Of Service (DOS)

Raneto is vulnerable to Denial of Service. The vulnerability is due to the GET search endpoint located at app/routes/search.route.js. An unauthenticated attacker can supply a malicious search query, crashing the program...

CVE-2022-23899

MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java...

PT-2021-23163 · Bookstack · Bookstack

Name of the Vulnerable Software and Affected Versions: BookStack versions prior to 21.11.3 Description: The issue allows a logged-in user with no privileges or a guest user if public access is enabled to access the "/search/users/select" AJAX endpoint, which is meant for admins to manage audit...

PT-2021-23562 · Unknown · Ifsc Code Finder Project

Name of the Vulnerable Software and Affected Versions: IFSC Code Finder Project version 1.0 Description: A SQL Injection issue exists via the searchifsccode POST parameter in the "/search.php" API endpoint. This allows for potential exploitation. No information is provided about the estimated...

PT-2020-13680 · Vmware · Harbor

Name of the Vulnerable Software and Affected Versions: Harbor versions 1.9. through 2.0. Description: The issue allows exposure of sensitive information to an unauthorized actor. Authenticated users can exploit an enumeration vulnerability in Harbor. The vulnerability is present in the "/users" A...

CVE-2020-25120

The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI...

newcastle.nsw.lions.org.au XSS vulnerability

Open Bug Bounty ID: OBB-678673 Description| Value ---|--- Affected Website:| newcastle.nsw.lions.org.au Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

tuugo.com.ve XSS vulnerability

Open Bug Bounty ID: OBB-662748 Description| Value ---|--- Affected Website:| tuugo.com.ve Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...