xuucms 3 SQL Injection

Exploit Title: xuucms 3 - 'keywords' SQL Injection Date: 2020-11-18 Exploit Author: icekam Vendor Homepage: https://www.cxuu.top/ Software Link: https://github.com/cbkhwx/cxuucmsv3 Version: cxuucms - v3 CVE : CVE-2020-28091 SQL injection exists in search.php. For details, please refer to:...

Sql injection

cxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords parameter via search.php...

CVE-2020-28091

cxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords parameter via search.php...

CVE-2020-28091

cxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords parameter via search.php...

PT-2020-16922

Name of the Vulnerable Software and Affected Versions cxuucms version 3 Description The issue is related to a SQL injection vulnerability. This vulnerability can lead to the leakage of all database data via the keywords parameter in the "search.php" endpoint. Recommendations For cxuucms version 3...

CVE-2020-28091: Improper Neutralization of Special Elements used in an SQL Command

cxuucms v3 has a SQL injection vulnerability, which can lead to the leakage of all database data via the keywords parameter via search.php...

CVE-2020-25271: Improper Neutralization of Input During Web Page Generation

PHPGurukul hospital-management-system-in-php 4.0 allows XSS via admin/patient-search.php, doctor/search.php, book-appointment.php, doctor/appointment-history.php, or admin/appointment-history.php...

CVE-2020-25120

The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI...

PT-2020-15960

Name of the Vulnerable Software and Affected Versions vBulletin version 5.6.3 Description The issue affects the Admin CP in vBulletin, where an XSS attack can be performed via the admincp/search.php?do=dosearch URI. Recommendations For version 5.6.3, consider restricting access to the...

CVE-2020-25120: Improper Neutralization of Input During Web Page Generation

The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI...

CVE-2020-23975

Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has cross site scripting via the 'search.php' id parameter...

Cross site scripting

Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has cross site scripting via the 'search.php' id parameter...

CVE-2020-23975

Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has cross site scripting via the 'search.php' id parameter...

CVE-2020-23975

CVE-2020-23975 affects Webexcels Ecommerce CMS 2.x (2017–2020). The vulnerability is a cross-site scripting flaw exploitable via the id parameter in search.php. No detailed exploit vectors or patch information are provided in the connected documents; remediation details are not stated. In summary...

CVE-2020-23975: Improper Neutralization of Input During Web Page Generation

Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has cross site scripting via the 'search.php' id parameter...

PT-2020-15609

Name of the Vulnerable Software and Affected Versions Webexcels Ecommerce CMS versions 2.x, 2017, 2018, 2019, 2020 Description The issue concerns a cross-site scripting problem. It is related to the "search.php" id parameter. Recommendations For Webexcels Ecommerce CMS versions 2.x, 2017, 2018,...

(0Day) Horde Groupware Webmail Edition Search vfolder Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Horde Groupware Webmail Edition. Authentication is required to exploit this vulnerability. The specific flaw exists within Search.php. When parsing the vfolder parameter, the process does not properl...

WordPress Sell Media Cross-Site Scripting Vulnerability

The WordPress plugin Sell Media is a tailored e-commerce solution that allows you to sell photos, prints, and videos through your self-hosted WordPress website. A cross-site scripting vulnerability exists in the /inc/class-search.php file in WordPress Sell Media v2.4.1. The vulnerability stems fr...

CVE-2019-6112

A Cross-site scripting XSS vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter aka $searchterm or the Search field...

PT-2020-11192

Name of the Vulnerable Software and Affected Versions Sell Media plugin version 2.4.1 for WordPress Description A Cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the keyword parameter also known as $search term or the Search field in the...