2934 matches found
CVE-2022-29399
TOTOLINK N600R V4.3.0cu.7647B20210106 was discovered to contain a stack overflow via the url parameter in the function FUN00415bf0...
CVE-2022-29748
Simple Client Management System 1.0 is vulnerable to SQL Injection via \cms\admin?page=client/manageclient=...
CVE-2022-27983
RG-NBR-E Enterprise Gateway RG-NBR2100G-E was discovered to contain an arbitrary file read vulnerability via the url parameter in check.php...
CVE-2022-2094
The Yellow Yard Searchbar WordPress plugin before 2.8.2 does not escape some URL parameters before outputting them back to the user, leading to Reflected Cross-Site Scripting...
CVE-2022-0656
The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udrawconverturltobase64 AJAX action available to both unauthenticated and authenticated users before using it in the filegetcontents function and returning its content base64 encoded in the...
CVE-2020-21665
In fastadmin V1.0.0.20191212beta, when a user with administrator rights has logged in, a malicious parameter can be passed for SQL injection in URL /admin/ajax/weigh...
CVE-2020-15887
A SQL injection vulnerability in softwareupdatecontroller.php in the Software Update module before 1.6 for MunkiReport allows attackers to execute arbitrary SQL commands via the last URL parameter of the /module/softwareupdate/gettabdata/ endpoint...
CVE-2020-36644
A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inlinesvg/actionview/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to...
CVE-2020-35930
Seo Panel 4.8.0 allows stored XSS by an Authenticated User via the url parameter, as demonstrated by the seo/seopanel/websites.php URI...
CVE-2020-18660
GetSimpleCMS =3.3.15 has an open redirect in admin/changedata.php via the redirect function to the url parameter...
CVE-2020-13484
Bitrix24 through 20.0.975 allows SSRF via an intranet IP address in the services/main/ajax.php?action=attachUrlPreview url parameter, if the destination URL hosts an HTML document containing 'meta name="og:image" content="' followed by an intranet URL...
CVE-2020-35589
The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by th...
CVE-2020-29135
cPanel before 90.0.17 has multiple instances of URL parameter injection SEC-567...
CVE-2020-18661
Cross Site Scripting XSS vulnerability in gnuboard5 =v5.3.2.8 via the url parameter to bbs/login.php...
CVE-2016-11015
NETGEAR JNR1010 devices before 1.0.0.32 allow cgi-bin/webproc CSRF via the :InternetGatewayDevice.XTWSZ-COMURLFilter.BlackList.1.URL parameter...
CVE-2019-6965
An XSS issue was discovered in i-doit Open 1.12 via the src/tools/php/qr/qr.php url parameter...
CVE-2019-8334
An issue was discovered in SchoolCMS 2.3.1. There is an XSS vulnerability via index.php?a=Index=Channel=Home=XSS...
CVE-2019-15810
Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter...