CVE-2020-35729

KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter...

KLog Server OS Command Injection Vulnerability

KLog is ZhaoKaiQiang KLog individual developers of a logging tool for Android development . The tool's main functions are to print line numbers, function calls, Json parsing, XML parsing, click to jump, Log information saved and other functions. KLog Server 2.4.1 suffers from an OS command...

PT-2020-14551 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to disclose sensitive information on affected installations without requiring authentication. The flaw exists within the ajax mail autoreply.php file,...

PT-2020-14429 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the ajax crons.php...

Cross-Site Scripting Vulnerability in Multiple Cambium Networks Products

The Cambium Networks Xirrus XR520, among others, is a wireless access point device from Cambium Networks, USA. A cross-site scripting vulnerability exists in the 'user' parameter of the cgi-bin/ViewPage.cgi file in multiple Cambium Networks products. The vulnerability stems from a lack of proper...

Cross site scripting

An issue was discovered on Xirrus XR520, XR620, XR2436, and XH2-120 devices. The cgi-bin/ViewPage.cgi user parameter allows XSS...

CVE-2020-8592

The CVE-2020-8592 entry concerns eG Manager 7.1.2, where the Forgot Password path (com.eg.LoginHelperServlet) is vulnerable to SQL Injection via the user parameter. The NVD entry cites a high/critical impact with CVSS v3.1: Network, LOW attack complexity, no privileges required, and high confiden...

CVE-2019-1010123

MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...

CVE-2019-13346

In MyT 1.5.1, the Userusername parameter has XSS...

Cross site scripting

In MyT 1.5.1, the Userusername parameter has XSS...

CVE-2019-13346

In MyT 1.5.1, the Userusername parameter has XSS...

CVE-2014-9917

An issue was discovered in Bilboplanet 2.0. There is a stored XSS vulnerability when adding a tag via the user/?page=tribes tags parameter...

CVE-2017-18364

phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter...

CVE-2019-9661

Stored XSS exists in YzmCMS 5.2 via the admin/systemmanage/userconfigedit.html "value" parameter,...

CVE-2018-1000833

ZoneMinder version = 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution...

CVE-2018-1000832

ZoneMinder version = 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution...

PHPOK 5.0.055 suffers from a SQL Injection Vulnerability

PHPOK system is a content management system for website construction developed by Shenzhen 锟铻科技有限公司formerly known as PHPOK Studio. A SQL injection vulnerability exists in PHPOK 5.0.055. The vulnerability is caused by poor filtering of user-submitted parameters. An attacker can exploit this...

TOTOLINK A3002RU System Command Injection Vulnerability (CNVD-2018-26674)

TOTOLINK A3002RU is a wireless router product from Gion Electronics TOTOLINK. A command injection vulnerability exists in formDlna in TOTOLINK A3002RU version 1.0.8. An attacker can exploit this vulnerability to execute system commands with the help of the 'ftpUser' POST parameter...

CVE-2018-18705

PhpTpoint hospital management system suffers from multiple SQL injection vulnerabilities via the index.php user parameter associated with LOGIN.php, or the rno parameter to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php...

Sql injection

PhpTpoint hospital management system suffers from multiple SQL injection vulnerabilities via the index.php user parameter associated with LOGIN.php, or the rno parameter to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php...