CVE-2023-49989

Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php...

CXBSoft Url-shorting SQL Injection Vulnerability

CXBSoft Url-shorting is CXBSoft open source a library that can shorten the URL . CXBSoft Url-shorting 1.3.1 and previous versions of the existence of SQL injection vulnerability , the vulnerability stems from the file /admin/pages/updatego.php parameter version of the existence of SQL injection...

Update Chrome now! Google patches critical vulnerability being exploited in the wild

Google has released an update for Chrome Desktop which includes one critical security fix. There is an active exploit for the patched vulnerability, according to Google, which means cybercriminals are aware of the vulnerability and are using it. If youre a Chrome user on Windows, Mac, or Linux, y...

CVE-2023-4869

A vulnerability was found in SourceCodester Contact Manager App 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file update.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been...

SourceCodester Contact Manager App Cross-Site Request Forgery Vulnerability

Contact Manager App is a contact manager application by the individual developer Remy Andrade. A cross-site request forgery vulnerability exists in SourceCodester Contact Manager App, which originates from a cross-site request forgery attack via the update.php page...

Inventory Management System Access Control Error Vulnerability

Inventory Management System is an inventory management system by the individual developers of stemword. An Access Control Error vulnerability exists in the SourceCodester Inventory Management System version 1.0 due to incorrect access control of the userid parameter on the editupdate.php page via...

GHSA-9436-3GMP-4F53 grav Server-side Template Injection (SSTI) mitigation bypass

Summary The fix for SSTI using |map, |filter and |reduce twigs implemented in the commit 71bbed1 introduces bypass of the denylist due to incorrect return value from isDangerousFunction, which allows to execute the payload prepending double backslash \ Details The isDangerousFunction check in...

PT-2023-23260 · Elementor · Elementor Pro

Name of the Vulnerable Software and Affected Versions: Elementor Pro versions up to, and including, 3.11.6 Description: The issue allows authenticated attackers with subscriber-level capabilities to update arbitrary site options, potentially leading to privilege escalation, due to a missing...

CVE-2023-25431

An issue was discovered in Online Reviewer Management System v1.0. There is a XSS vulnerability via reviewer0/admins/assessments/course/course-update.php...

CVE-2022-36609

Clinic's Patient Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pms/updatepatient.php...

Web Based Quiz System SQL注入漏洞

Web Based Quiz System is a web based quiz system by janobe individual developers. A security vulnerability exists in Web Based Quiz System v1.0, which can be exploited by an attacker to perform SQL injection via the qid parameter of the update.php component...

Nesote Technologies Inout Blockchain AltExchanger SQL注入漏洞

Nesote Technologies Inout Blockchain AltExchanger is a premium and secure cryptocurrency exchange platform script by Nesote Technologies India. It helps you to start cryptocurrency exchange service online. Nesote Technologies Inout Blockchain AltExchanger version 1.2.1 suffers from a SQL injectio...

JIZHICMS 代码问题漏洞

JIZHICMS JIZHICMS is an open source Content Management System CMS from China's JIZHICMS Network Technology Company. A security vulnerability exists in JIZHICMS v1.9.5, which originates from a server-side request forgery SSRF vulnerability in /admin.php/Plugins/update.html...

PT-2021-10202 · Gnuboard5 · Gnuboard5

Name of the Vulnerable Software and Affected Versions: gnuboard5 versions prior to 5.3.2.8 Description: The issue is related to a Cross Site Scripting XSS vulnerability. It can be exploited via the act parameter in the "bbs/move update.php" endpoint. Recommendations: For versions prior to 5.3.2.8...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress plugin Advanced Custom Fields Pro versions...

ASUS RT-AC1900P routers cross-site scripting vulnerability

ASUS RT-AC1900P routers is a router device. A cross-site scripting vulnerability exists in the ASUS RT-AC1900P routers firmware update page, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to gain access to sensitive information or hijack user...

Realization Concerto Critical Chain Planner SQL Injection Vulnerability

Realization Concerto Critical Chain Planner CCPM is a project management software package. A SQL injection vulnerability exists in the taskupdt/taskdetails.aspx web page in Realization CCPM version 5.10.8071. The vulnerability stems from a database-based application that lacks validation of...

PHP Scripts Mall Chartered Accountant:Auditor Website Cross-Site Scripting Vulnerability

PHP Scripts Mall Chartered Accountant:Auditor Website is an accounting auditor website system script from PHP Scripts Mall, India. A cross-site scripting vulnerability exists in the Profile Update page in PHP Scripts Mall Chartered Accountant : Auditor Website version 2.0.1, which can be exploite...

CVE-2019-7553

PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field...

DouCo DouPHP Cross-Site Scripting Vulnerability (CNVD-2019-00999)

DouCo DouPHP is a lightweight open source CMS Content Management System based on PHP and MySQL. A cross-site scripting vulnerability exists in admin/article.php?rec=update in DouCo DouPHP version 1.5 20181221. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...