CVE-2018-18705

PhpTpoint hospital management system suffers from multiple SQL injection vulnerabilities via the index.php user parameter associated with LOGIN.php, or the rno parameter to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php...

CVE-2018-18705

PhpTpoint Hospital Management System (PHP) contains multiple SQL injection vulnerabilities reachable via index.php (user parameter in LOGIN.php) and via rno parameters to ALIST.php, DUNDEL.php, PDEL.php, or PUNDEL.php. Exploitation could allow bypassing login to obtain database information or exe...

Denial Of Service (DoS)

privacyIDEA is vulnerable to denial of service DoS attacks. The library does not properly validate the user parameter, allowing a malicious user to pass a HTTP request with an empty user parameter to quickly trigger the 10 attempt limit lock out...

PvPGN Stats SQL Injection Vulnerability

PvPGN Stats is a PHP-based tool that supports the integration of websites with the PvPGN game server, displaying server status, ladder pages, and more. A SQL injection vulnerability exists in the ladder/stats.php file in PvPGN Stats version 2.4.6, which stems from the program failing to filter...

CVE-2017-18291

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET user parameter...

CVE-2017-18291

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET user parameter...

CVE-2018-9991

Frog CMS 0.9.5 has XSS via the /admin/?/user/add Name or Username parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Gespage before 7.4.9 allow remote attackers to inject arbitrary web script or HTML via the 1 printer name when adding a printer in the admin panel or 2 username parameter to webapp/users/userreg.jsp...

CVE-2015-3934

Multiple SQL injection vulnerabilities in Fiyo CMS 2.01.9.1 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to apps/apparticle/controller/rating.php or 2 user parameter to user/login...

WordPress Support Ticket System SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Support Ticket System plugin is one of the ticket system plugin. A SQL injection vulnerability exists in WordPress...

PHPSHE B2C mall system user.php parameter has sql injection vulnerability

PHPSHE mall system is a combination of product display, online shopping, order management, payment management, article management, customer consultation feedback and other functions, providing users with online shopping mall construction program. A SQL injection vulnerability exists in the user.p...

SimpleRisk Cross-Site Scripting Vulnerability

SimpleRisk is an open source risk management tool developed by American software developer Josh Sokol. The tool tracks and displays the status of systems, teams and security technologies as well as ongoing risk mitigation projects through a risk management dashboard. A cross-site scripting...

CVE-2017-10711

In SimpleRisk 20170614-001, a CSRF attack on reset.php aka the Send Password Reset Email form can insert XSS sequences via the user parameter...

CVE-2017-10711

In SimpleRisk 20170614-001, a CSRF attack on reset.php aka the Send Password Reset Email form can insert XSS sequences via the user parameter...

CVE-2017-10711

In SimpleRisk 20170614-001, a CSRF attack on reset.php aka the Send Password Reset Email form can insert XSS sequences via the user parameter...

NEC UNIVERGE UM4730 < 11.8 - SQL Injection

Exploit Title: NEC UNIVERGE UM4730 11.8 SQL injection Vulnerbility: SQL injection login bypass Date: 15-12-2016 Exploit Author: b0x41s Author web: https://www.xrayit.nl Vendor Homepage: https://www.nec-enterprise.com Category: webapps Version: 11.6.0.31 Tested on: Windows server 2008 Description:...

KMCIS CaseAware - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: CaseAware Cross Site Scripting Vulnerability Date: 20th May 2017 Exploit Author: justpentest Vendor Homepage: https://caseaware.com/ Version: All the versions Contact: email protected CVE : 2017-5631 Source:...

CaseAware Cross Site Scripting

Exploit Title: CaseAware Cross Site Scripting Vulnerability Date: 20th May 2017 Exploit Author: justpentest Vendor Homepage: https://caseaware.com/ Version: All the versions Contact: [email protected] CVE : 2017-5631 Source:...

KMCIS CaseAware - Cross-Site Scripting

KMCIS CaseAware - Cross-Site Scripting Exploit Title: CaseAware Cross Site Scripting Vulnerability Date: 20th May 2017 Exploit Author: justpentest Vendor Homepage: https://caseaware.com/ Version: All the versions Contact: [email protected] CVE : 2017-5631 Source:...

KMCIS CaseAware - Cross-Site Scripting

Exploit Title: CaseAware Cross Site Scripting Vulnerability Date: 20th May 2017 Exploit Author: justpentest Vendor Homepage: https://caseaware.com/ Version: All the versions Contact: [email protected] CVE : 2017-5631 Source:...