CVE-2022-32342

Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/roomtypes/viewroomtype.php?id=...

Server-Side Template Injection

nystudio107/craft-seomatic is vulnerable to server-side template injection. The vulnerability exists due to the lack of sanitization used for the url parameter in the safeCanonicalUrl function of Helper.php, allowing an attacker to inject and execute malicious code...

PT-2022-11474

Name of the Vulnerable Software and Affected Versions SEOmatic plugin version 3.4.10 for Craft CMS 3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script via a GET to "/index.php?action=seomatic/file/seo-file-link" with url parameter containing the...

CVE-2021-41750: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName...

CVE-2022-31386

A Server-Side Request Forgery SSRF in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the URL parameter...

Barco Control Room Cross-Site Scripting Vulnerability

Barco Control Room is a visualization and collaboration solution from Barco Belgium. Used to build control rooms, a cross-site scripting vulnerability exists in the Barco Control Room Management Suite web application prior to version 3.14. The vulnerability stems from the URL parameter of the...

PT-2022-20725

Name of the Vulnerable Software and Affected Versions nbnbk cms version 3 Description A Server-Side Request Forgery SSRF issue exists in the getFileBinary function, allowing attackers to force the application to make arbitrary requests by injecting arbitrary URLs into the URL parameter...

CVE-2022-31386: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the URL parameter...

Cross site scripting

kkFileView v4.0.0 was discovered to contain a cross-site scripting XSS vulnerability via the url parameter at /controller/OnlinePreviewController.java...

Keking kkFileView 跨站脚本漏洞

Keking KkFileview is a Spring-Boot build file document online preview project from Keking Technology Keking, China. A security vulnerability exists in kkFileView version 4.0.0, which originates from. A cross-site scripting XSS vulnerability was found via the url parameter in...

CVE-2022-29349

kkFileView v4.0.0 was discovered to contain a cross-site scripting XSS vulnerability via the url parameter at /controller/OnlinePreviewController.java...

CVE-2022-29349

kkFileView v4.0.0 was discovered to contain a cross-site scripting XSS vulnerability via the url parameter at /controller/OnlinePreviewController.java...

CVE-2022-29349

kkFileView 4.0.0 is affected by CVE-2022-29349, with multiple XSS vulnerabilities exposed via the url/currentUrl parameters in /controller/OnlinePreviewController.java. The issue enables injection of script code into a victim’s browser, potentially enabling session hijacking, defacement, or leaka...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the currentURL parameter on the Portal Workflow module's edit process page, which is accepted and rendered without sanitization. Details Cross-site scripting or XSS is a code vulnerability that occurs when a...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the redirect URL parameter. An attacker can execute arbitrary scripts in the context of a user's browser by convincing the user to follow a crafted link. Details Cross-site scripting or XSS is a code...

CVE-2022-29349: Improper Neutralization of Input During Web Page Generation

kkFileView v4.0.0 was discovered to contain a cross-site scripting XSS vulnerability via the url parameter at /controller/OnlinePreviewController.java...

PT-2022-19555

Name of the Vulnerable Software and Affected Versions kkFileView version 4.0.0 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability can be exploited via the url parameter at the "/controller/OnlinePreviewController.java" endpoint. Recommendations For...

PT-2022-19316

Name of the Vulnerable Software and Affected Versions Subconverter version 0.7.2 Description A remote code execution issue allows attackers to execute arbitrary code by crafting specific config and url parameters. Recommendations For Subconverter version 0.7.2, at the moment, there is no...

CVE-2022-29642

TOTOLINK A3100R V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 were discovered to contain a stack overflow via the url parameter in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...

Stack overflow

TOTOLINK A3100R V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 were discovered to contain a stack overflow via the url parameter in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted POST request...