37 matches found
CVE-2026-31939
Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $REQUEST'test' is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerabilit...
EUVD-2026-18408
A vulnerability was detected in Trendnet TEW-657BRM 1.00.1. Affected is the function pingtest of the file /setup.cgi. Performing a manipulation of the argument c4IPAddr results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The...
The vulnerability of the OpenSky flight planning and operational management system, related to the lack of measures to protect the SQL query structure, allows attackers to execute arbitrary SQL queries.
The vulnerability of the OpenSky flight planning and operational management system lies in the lack of measures taken to protect the SQL query structure during the processing of the gettest parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...
EUVD-2002-1620
Malware in sbrugna...
CVE-2022-29728
Survey Sparrow Enterprise Survey Software 2022 has a Reflected cross-site scripting XSS vulnerability in the test parameter...
CVE-2018-10128
An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php...
CVE-2025-47423: Path Traversal: '../filedir'
Personal Weather Station Dashboard 12lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in the test parameter to /others/test.php, as demonstrated by reading the server's private SSL key in cleartext...
PT-2024-26872 · Engenius · Engenius Enstation5-Ac
Name of the Vulnerable Software and Affected Versions: EnGenius EnStation5-AC A8J-ENS500AC version 1.0.0 Description: The issue allows blind OS command injection via shell metacharacters in the Ping and Speed Test parameters. This can potentially be exploited to execute unauthorized commands on t...
Kashipara Music Management System 安全漏洞
Kashipara Music Management System is a music management system from Kashipara. A cross-site scripting vulnerability exists in Kashipara Music Management System v1.0, which stems from the lack of effective filtering and escaping of user-supplied data in the page parameter of...
CVE-2022-43051
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=deletetest...
CVE-2022-29728
Survey Sparrow Enterprise Survey Software 2022 has a Reflected cross-site scripting XSS vulnerability in the test parameter...
Cross site scripting
Survey Sparrow Enterprise Survey Software 2022 has a Reflected cross-site scripting XSS vulnerability in the test parameter...
CVE-2022-29728: Improper Neutralization of Input During Web Page Generation
Survey Sparrow Enterprise Survey Software 2022 has a Reflected cross-site scripting XSS vulnerability in the test parameter...
CVE-2021-24778: Improper Neutralization of Special Elements used in an SQL Command
The test parameter of the xmlfeed in the Tradetracker-Store WordPress plugin before 4.6.60 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...
CVE-2021-31987
A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to bypass blocked network recipients...
Wordpress Load More SQL注入漏洞
Wordpress Load More is Wordpress an open source application plugin . Provide a load more items function . WordPress Load More plugin before 5.3.2 SQL injection vulnerability exists , the vulnerability stems from /wp-admin/admin-ajax.php repeater parameter or type=test parameter...
paypal-ipn spoofing vulnerability
paypal-ipn is a node.js package for validating PayPal IPN messages. A security vulnerability exists in paypal-ipn versions prior to 3.0.0. An attacker can exploit this vulnerability by using an emulator build request to spoof arbitrary applications that do not detect the 'testipn' parameter...
XYHCMS Cross-Site Scripting Vulnerability
XYHCMS is an open source content management system CMS. A cross-site scripting vulnerability exists in XYHCMS version 3.5. A remote attacker can exploit this vulnerability by sending the 'test' parameter to the index.php file to execute JavaScript code...