GHSA-7WQ3-JR35-275C Directus `search` query parameter allows enumeration of non permitted fields

Summary The search query parameter allows users with access to a collection to filter items based on fields they do not have permission to view. This allows the enumeration of unknown field contents. Details The searchable columns numbers & strings are not checked against permissions when injecti...

Directus 信息泄露漏洞

Directus is a real-time Api and application dashboard open-sourced by Directus. It is used to manage Sql database content. An information disclosure vulnerability exists in Directus versions prior to 9.0.0-alpha.4 through 11.5.0, which stems from the search parameter that can lead to unauthorized...

PT-2025-12983 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions 9.0.0-alpha.4 through 11.5.0 Description: The issue allows users with access to a collection to filter items based on fields they do not have permission to view using the search query parameter. This enables the enumeration ...

PHPGurukul Art Gallery Management System 注入漏洞

Art Gallery Management System is an art gallery management system. Art Gallery Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter Search of /search.php. An attacker can exploit this...

WordPress plugin SEO Plugin by Squirrly SEO SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

WordPress SEO Plugin by Squirrly SEO plugin <= 12.4.05 - Authenticated (Subscriber+) SQL Injection via search Parameter vulnerability

Authenticated Subscriber+ SQL Injection via search Parameter vulnerability discovered by Muhamad Visat Sutarno in WordPress Plugin SEO Plugin by Squirrly SEO versions = 12.4.05...

CVE-2025-2047

A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /search.php. The manipulation of the argument search leads to cross site scripting. It is possible to initiate the attack remotely. The exploi...

CVE-2025-1702 Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 2.10.0 due to insufficient escaping on the user suppli...

WordPress Ultimate Member plugin <= 2.10.0 - Unauthenticated SQL Injection via search Parameter vulnerability

Unauthenticated SQL Injection via search Parameter vulnerability discovered by mikemyers in WordPress Plugin Ultimate Member versions = 2.10.0...

CVE-2025-1196

A vulnerability, which was classified as problematic, was found in code-projects Real Estate Property Management System 1.0. Affected is an unknown function of the file /search.php. The manipulation of the argument PropertyName leads to cross site scripting. It is possible to launch the attack...

CVE-2024-57326

A Reflected Cross-Site Scripting XSS vulnerability exists in the search.php file of the Online Pizza Delivery System 1.0. The vulnerability allows an attacker to execute arbitrary JavaScript code in the browser via unsanitized input passed through the search parameter...

PT-2025-3823

Name of the Vulnerable Software and Affected Versions The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress versions up to, and including, 2.9.1 Description The issue is related to time-based SQL Injection via the...

mblog 代码注入漏洞

mblog is a blogging system by langhsu individual developer. A code injection vulnerability exists in mblog version 3.5.0, which stems from the parameter kw in the file /search that leads to cross-site scripting...

Human Resource Management System 注入漏洞

Human Resource Management System is a human resource management system by maverickosama Personal Developer. An injection vulnerability exists in Human Resource Management System version 1.0, which is caused by an SQL injection vulnerability in the search parameter of the /employeeview.php file...

Complaint Management System user-search.php File SQL Injection Vulnerability

Complaint Management System is a complaint management system. Complaint Management System suffers from a SQL injection vulnerability that stems from an incorrect manipulation of the parameter search in the file /admin/user-search.php that can lead to sql injection. No details of the vulnerability...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the search parameter. An attacker can execute scripts by convincing a user to click a malicious link, and then click the search bar on the target page. Details Cross-site scripting or XSS is a code...

CVE-2024-50677

A cross-site scripting XSS vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter...

CVE-2024-50677

CVE-2024-50677 describes a cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 where an attacker can inject a crafted payload into the Search parameter to execute arbitrary web scripts or HTML. The root cause is improper handling/validation of user input in the search functionality, ...

OroPlatform 安全漏洞

OroPlatform is an Oro open source PHP Business Application Platform BAP designed to make custom business application development easier and faster. A security vulnerability exists in OroPlatform version v5.1, which stems from vulnerability to cross-site scripting attacks, where an attacker can...

PT-2024-34389 · Oro · Oroplatform Cms

Name of the Vulnerable Software and Affected Versions: OroPlatform CMS version 5.1 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter. This enables attackers to potentially manipulate...