myfactory FMS - Cross-Site Scripting

myfactory.FMS before 7.1-912 allows cross-site scripting via the UID parameter. id: CVE-2021-42565 info: name: myfactory FMS - Cross-Site Scripting author: madrobot,daffainfo severity: medium description: | myfactory.FMS before 7.1-912 allows cross-site scripting via the UID parameter. impact: |...

CVE-2023-43341-Evolution-Reflected-XSS---Installation-Connection-

Evolution CMS 반사형 XSS v3.2.3 작성자: Sergio 설명: Evolution v.3.2.3 설치 프로세스 연결의 uid 매개변수에 조작된 페이로드를 주입하여 로컬 공격자가 임의의 웹 스크립트를 실행할 수 있는 반사형 크로스 사이트 스크립팅XSS 취약점입니다. 공격 벡터: 데이터베이스 설치 프로세스의 uid 매개변수에 대한 정화 취약점으로 인해 JavaScript 코드가 주입될 수 있습니다. POC: 설치 과정에서 uid 매개변수에 XSS 페이로드를 입력하고 다음을 클릭하면 XSS 팝업이 표시됩니다. XSS...

EUVD-2026-66388

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-96599

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer...

EUVD-2026-85340

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer...

CVE-2026-96599

Versions of Isotope eCommerce through 2.9.10 are vulnerable to an identifier prediction flaw. The application uses the uniqid() function rather than a cryptographically secure source to generate order identifiers. Because guest orders lack proper ownership verification, an unauthenticated attacke...

CVE-2026-96599 Isotope eCommerce through 2.9.10 Weak Order Identifier Generation

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer...

CVE-2026-96599 Isotope eCommerce through 2.9.10 Weak Order Identifier Generation

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer...

PT-2026-97345

Name of the Vulnerable Software and Affected Versions Isotope eCommerce versions prior to 2.9.11 Description The software generates order identifiers using the uniqid function rather than a cryptographically secure source, which allows unauthenticated attackers to predict these identifiers. Becau...

CVE-2026-80349

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-80349 TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-80349 TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

CVE-2026-80349

TarsWeb through 3.0.14 contains a critical authentication bypass (CVSS 9.8). The root cause is a combination of two misconfigurations: Koa's proxy option is set to true without restricting trusted upstream proxies, so the source address is taken from the caller-controlled X-Forwarded-For header; ...

CVE-2026-80349 TarsWeb through 3.0.14 Authentication Bypass via Spoofed X-Forwarded-For and uid Parameter

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's proxy option to true without naming which upstream proxies may be trusted and without limiting the number of forwarded hops, so the request address Koa reports is taken from the...

PT-2026-82067

Name of the Vulnerable Software and Affected Versions TarsWeb versions prior to 3.0.16 Description TarsWeb incorrectly determines if a request originates from a trusted local caller by relying on a client-controlled header. The app.js file enables the Koa proxy option without specifying trusted...

CVE-2025-5017

Summary: The Catalyst Connect Zoho CRM Client Portal WordPress plugin (≤ 2.2.0) is vulnerable to time-based SQL Injection via the uid parameter. The root cause is insufficient escaping of user input and lack of proper query parameterization, enabling authenticated attackers with Administrator-lev...

EUVD-2025-210456

The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uid’ parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2025-5017 Catalyst Connect Zoho CRM Client Portal <= 2.2.0 - Authenticated (Administrator+) SQL Injection via uid Parameter

The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uid’ parameter in all versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

EUVD-2024-55647

Landray OA contains an unauthenticated HQL injection vulnerability that allows unauthenticated attackers to query arbitrary Hibernate entity classes by injecting malicious HQL syntax into the uid POST parameter of the wechatLoginHelper.do endpoint. Attackers can exploit the lack of input...

CVE-2024-58352

Landray OA is affected by an unauthenticated HQL injection through the wechatLoginHelper.do endpoint’s uid parameter. The vulnerability stems from a string-concatenated filter expression passed to Hibernate findList(), enabling attackers to query arbitrary Hibernate entity classes and extract sen...