CVE-2020-15617

This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxlistaccounts.php. When parsing the status parameter, the...

PT-2020-14540 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to disclose sensitive information on affected installations without requiring authentication. The flaw exists within the ajax list accounts.php file,...

The vulnerability of the OAuth2 extension for the software environment used to implement the MediaWiki hypertext environment allows a hacker to perform cross-site request forgeing attacks.

The vulnerability of the OAuth2 extension for implementing the MediaWiki hypertext environment is related to the absence of a check on the OAuth2 status parameter in the callback function. Exploiting this vulnerability allows a malicious actor to perform cross-site forged requests...

CVE-2019-8424

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter...

DEBIAN-CVE-2019-8424

ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php sort parameter...

CrashFix SQL Injection Vulnerability

CrashFix is a backend analysis tool for CrashRpt. The tool is mainly used to receive, store, organize and analyze error reports sent by CrashRpt. A SQL injection vulnerability exists in CrashFix version 1.0.4. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands with...

CVE-2018-20508

CrashFix 1.0.4 has SQL Injection via the Userstatus parameter. This is related to actionIndex in UserController.php, and the protected\models\User.php search function...

Sql injection

CrashFix 1.0.4 has SQL Injection via the Userstatus parameter. This is related to actionIndex in UserController.php, and the protected\models\User.php search function...

CVE-2018-18551

ServersCheck Monitoring Software through 14.3.3 has Persistent and Reflected XSS via the sensors.html status parameter, sensors.html type parameter, sensors.html device parameter, report.html location parameter, groupdelete.html group parameter, reportsave.html query parameter, sensors.html...

Cross-Site Scripting (XSS)

dojo is vulnerable to cross-site scripting. User input is not sanitized in the server response before being displayed on a user's browser. An attacker is able to inject arbitrary Javascript into a victim's browser through a crafted URL via the status parameter...

Skybox Platform Cross-Site Scripting Vulnerability (CNVD-2018-01461)

Skybox PlatformAn enterprise-grade network security management platform from US-based Skybox Security. The platform features attack vector analysis, firewall management, vulnerability and threat management, and more. A cross-site scripting vulnerability exists in...

Cross site scripting

An issue was discovered in Skybox Platform before 7.5.401. Reflected cross-site scripting vulnerabilities exist in /skyboxview/webservice/services/VersionRepositoryWebService via a soapenv:Body element, or in the status parameter to login.html...

CVE-2015-9247: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Skybox Platform before 7.5.401. Reflected cross-site scripting vulnerabilities exist in /skyboxview/webservice/services/VersionRepositoryWebService via a soapenv:Body element, or in the status parameter to login.html...

PT-2018-4559

Name of the Vulnerable Software and Affected Versions Skybox Platform versions prior to 7.5.401 Description An issue exists in the software where reflected cross-site scripting vulnerabilities can be exploited. This can occur through the "soapenv:Body" element in the...

Evolution Script CMS Cross-Site Scripting Vulnerability

Evolution Script is managed by a team of professionals specializing in pay-per-click software development. A cross-site scripting vulnerability exists in the "status" parameter of the "Ticket Support" module of Evolution Script CMS version 5.3, which can be exploited by remote attackers to inject...

Fast Breakfast App Has Arbitrary User Payment Password Change Vulnerability

Fast Breakfast APP is a mobile service software. There is an arbitrary user payment password modification vulnerability in Fast Breakfast APP. Due to the use of loginStatus and userTel parameters to query the userID of any user, it is possible to modify the payment password of any user...

Sql injection

Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow 1 remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or 2 remote administrators to execute arbitrary SQL commands via the status parameter to...

CVE-2012-1665

Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow 1 remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or 2 remote administrators to execute arbitrary SQL commands via the status parameter to...

CVE-2012-6691

Multiple cross-site request forgery CSRF vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the 1 status parameter to admin/statsmonthlysales.php or 2 country parameter...

PT-2015-3537

Name of the Vulnerable Software and Affected Versions osCMax versions prior to 2.5.1 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities in the admin panel. These vulnerabilities allow remote attackers to hijack the authentication of administrators for requests...