712 matches found
Enhancesoft osTicket SQL Injection Vulnerability
Enhancesoft osTicket is an open source ticketing system from Enhancesoft, Inc. A security vulnerability exists in Enhancesoft osTicket v1.15.6, which originates from an SQL injection vulnerability in the Search function of the tickets.php page, allowing an authenticated attacker to execute...
CVE-2023-40594 Denial of Service (DoS) via the ‘printf’ Search Function
In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can use the printf SPL function to perform a denial of service DoS against the Splunk Enterprise instance...
MotoCMS SQL Injection Vulnerability
MotoCMS is a simple website builder from MotoCMS. MotoCMS version v3.4.3 suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. The vulnerability can be exploited by an attacker to gain privileges via the keyword...
CVE-2023-36213
SQL injection vulnerability in MotoCMS v.3.4.3 allows a remote attacker to gain privileges via the keyword parameter of the search function...
Sql injection
SQL injection vulnerability in MotoCMS v.3.4.3 allows a remote attacker to gain privileges via the keyword parameter of the search function...
CVE-2023-36213
SQL injection vulnerability in MotoCMS v.3.4.3 allows a remote attacker to gain privileges via the keyword parameter of the search function...
PT-2023-25484
Name of the Vulnerable Software and Affected Versions MotoCMS version 3.4.3 Description A SQL injection issue allows a remote attacker to gain privileges via the keyword parameter of the search function. This enables the attacker to potentially access or manipulate sensitive data. Recommendations...
CVE-2023-36213: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in MotoCMS v.3.4.3 allows a remote attacker to gain privileges via the keyword parameter of the search function...
CVE-2023-36213
SQL injection vulnerability in MotoCMS v.3.4.3 allows a remote attacker to gain privileges via the keyword parameter of the search function...
PT-2023-20796 · Mccms · Mccms
Name of the Vulnerable Software and Affected Versions: mccms version 2.6 Description: The issue allows remote attackers to run arbitrary SQL commands via the Author Center -Reader Comments -Search function. This can be exploited by accessing the Author Center and then navigating to Reader Comment...
Pimcore Remote Code Execution vulnerability in Search function
Impact Attacker can get full DB and maybe RCE knowing the WEBROOT path Patches Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/commit/367b74488808d71ec3f66f4ca9e8df5217c2c8d2.patch Workarounds Apply patch...
GHSA-42C3-WVWW-GCQJ Pimcore Remote Code Execution vulnerability in Search function
Impact Attacker can get full DB and maybe RCE knowing the WEBROOT path Patches Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/commit/367b74488808d71ec3f66f4ca9e8df5217c2c8d2.patch Workarounds Apply patch...
SQL injection search function
Description Please enter a description of the vulnerability. Link POC: https://drive.google.com/drive/folders/1oFZPVrJ7lID7tDArO8spsMy1VYr4oOb?usp=sharing Proof of Concept Step 1: login https://demo.pimcore.fun/admin/ Step 2: user search function and intercept request with burp Step 3: Exploit ti...
SUSE CVE-2018-14648
A flaw was found in 389 Directory Server. A specially crafted search query could lead to excessive CPU consumption in the dosearch function. An unauthenticated attacker could use this flaw to provoke a denial of service...
CVE-2022-45730
A cross-site scripting XSS vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search function...
CVE-2022-45730
A cross-site scripting XSS vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search function...
Cross site scripting
A cross-site scripting XSS vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search function...
Doctor Appointment Management System Cross-site Scripting Vulnerability
Doctor Appointment Management System is a Doctor Appointment Management System by the individual developer ANUJ KUMAR. A security vulnerability exists in Doctor Appointment Management System version v1.0.0, which originates from cross-site scripting XSS and allows an attacker to execute arbitrary...
PT-2023-14740 · Unknown · Doctor Appointment Management System
Name of the Vulnerable Software and Affected Versions: Doctor Appointment Management System version 1.0.0 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search function. Recommendations: For Doctor...