CVE-2021-21024

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is...

CVE-2021-21024: Improper Neutralization of Special Elements used in an SQL Command

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is...

WordPress Cross-Site Scripting Vulnerability (CNVD-2020-27082)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Search module in WordPress versions 5.2 through 5.4. The...

CVE-2019-7885

Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerability could be abused by an authenticated user with the ability to configure th...

CVE-2019-7885: Improper Input Validation

Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerability could be abused by an authenticated user with the ability to configure th...

PT-2019-18805

Name of the Vulnerable Software and Affected Versions Magento 2.1 versions 2.1.0 through 2.1.17 Magento 2.2 versions 2.2.0 through 2.2.8 Magento 2.3 versions 2.3.0 through 2.3.1 Description The issue is related to insufficient input validation in the config builder of the Elastic search module,...

SQL Injection Vulnerability in HNCMS Search Module

HNCMS is based on PHP + MYSQL as the core development, free + open source Chinese labeling system. HNCMS search module SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive database information...

museudaciencia.pt XSS vulnerability

Open Bug Bounty ID: OBB-598382 Description| Value ---|--- Affected Website:| museudaciencia.pt Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

YzmCMS 3.6 - Cross-Site Scripting

YzmCMS 3.6 - Cross-Site Scripting Exploit Title: YzmCMS 3.6 XSS Vulnerability Date: 2018-04-03 Exploit Author: zzw [email protected] Vendor Homepage: http://www.yzmcms.com/ Software Link: http://www.yzmcms.com/ Version: 3.6 CVE : CVE-2018-7653 This is a XSS vulnerability than can attack the users...

eZ Publish search module cross-site scripting vulnerability

eZ Publish is a Norwegian eZ Systems open source PHP content management system and development framework CMS/CMF. The system provides freely customizable and extensible content model for news distribution , e-commerce B2B and B2C, portals and community sites . search module is one of the search...

CVE-2017-1000431

eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials...

Design/Logic Flaw

eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials...

CVE-2017-1000431

eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials...

CVE-2017-1000431

eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials...

CVE-2017-1000431

CVE-2017-1000431 affects eZ Publish: versions 5.4.0–5.4.9 and 5.3.12 and older. The vulnerability is an XSS in the search module that could allow an attacker to inject scripts and potentially steal authentication credentials. The linked sources (e.g., ezpublish advisory and security pages) confir...

CVE-2017-1000431

eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials...

PT-2018-5205

Name of the Vulnerable Software and Affected Versions eZ Publish versions 5.3.12 and older, 5.4.0 through 5.4.9 Description The issue is related to an XSS problem in the search module, allowing attackers to inject scripts that may steal authentication credentials. Recommendations For versions...

CVE-2017-1000431: Improper Neutralization of Input During Web Page Generation

eZ Systems eZ Publish version 5.4.0 to 5.4.9, and 5.3.12 and older, is vulnerable to an XSS issue in the search module, resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials...

CVE-2017-9338

Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2. To be exploitable a user has to write or paste malicious content into the search dialogue...

CVE-2017-9338

Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before 9.1.6, and 10.0.x before 10.0.2. To be exploitable a user has to write or paste malicious content into the search dialogue...