CVE-2021-38157: Improper Neutralization of Input During Web Page Generation

LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

PT-2021-21974 · Unknown · Leostream Connection Broker

Name of the Vulnerable Software and Affected Versions: LeoStream Connection Broker versions 9.x before 9.0.34.3 Description: The issue allows Unauthenticated Reflected XSS via the "/index.pl" API endpoint, specifically through the user parameter. This affects products that are no longer supported...

Leostream Connection Broker cross-site scripting vulnerability

Leostream Connection Broker is a vendor-neutral connection broker from Leostream, Inc. that provides a single interface to manage a range of operating systems, physical and virtual desktops, and display protocols that are common in enterprise environments. A cross-site scripting vulnerability...

CVE-2021-25209

SQL injection vulnerability in SourceCodester Theme Park Ticketing System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to viewuser.php...

CVE-2021-26226

SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edituser.php...

CVE-2020-20474

White Shark System WSS 1.3.2 has a SQL injection vulnerability. The vulnerability stems from the defaulttaskedituser.php files failing to filter the csatouser parameter. Remote attackers can exploit the vulnerability to obtain database sensitive information...

Default configuration

Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for...

CVE-2020-23517: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in Aryanic HighMail High CMS versions 2020 and before allows remote attackers to inject arbitrary web script or HTML, via 'user' to LoginForm...

CVE-2020-35741

HGiga MailSherlock contains a cross-site scripting (XSS) vulnerability: it does not validate user parameters on multiple login pages, allowing an attacker to inject JavaScript syntax. The CVE entry CVE-2020-35741 is documented across multiple sources (NVD and CNVD) with this behavior. Impact deta...

CVE-2020-35729

KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter...

CVE-2020-35729: Improper Neutralization of Special Elements used in an OS Command

KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter...

KLog Server OS Command Injection Vulnerability

KLog is ZhaoKaiQiang KLog individual developers of a logging tool for Android development . The tool's main functions are to print line numbers, function calls, Json parsing, XML parsing, click to jump, Log information saved and other functions. KLog Server 2.4.1 suffers from an OS command...

PT-2020-17406

Name of the Vulnerable Software and Affected Versions KLog Server version 2.4.1 Description The issue allows OS command injection via shell metacharacters in the user parameter of the "actions/authenticate.php" API endpoint. Recommendations For KLog Server version 2.4.1, avoid using the user...

PT-2020-14551 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to disclose sensitive information on affected installations without requiring authentication. The flaw exists within the ajax mail autoreply.php file,...

PT-2020-14429 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the ajax crons.php...

Cross-Site Scripting Vulnerability in Multiple Cambium Networks Products

The Cambium Networks Xirrus XR520, among others, is a wireless access point device from Cambium Networks, USA. A cross-site scripting vulnerability exists in the 'user' parameter of the cgi-bin/ViewPage.cgi file in multiple Cambium Networks products. The vulnerability stems from a lack of proper...

Cross site scripting

An issue was discovered on Xirrus XR520, XR620, XR2436, and XH2-120 devices. The cgi-bin/ViewPage.cgi user parameter allows XSS...

CVE-2020-8592

The CVE-2020-8592 entry concerns eG Manager 7.1.2, where the Forgot Password path (com.eg.LoginHelperServlet) is vulnerable to SQL Injection via the user parameter. The NVD entry cites a high/critical impact with CVSS v3.1: Network, LOW attack complexity, no privileges required, and high confiden...

PT-2020-20226

Name of the Vulnerable Software and Affected Versions eG Manager version 7.1.2 Description The issue allows SQL Injection via the user parameter to the com.eg.LoginHelperServlet, which is part of the Forgot Password feature. Recommendations For eG Manager version 7.1.2, consider restricting acces...

CVE-2019-1010123

MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...