244 matches found
Cross site scripting
NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name of a physician, assistant, or billing user can have a JavaScript payload that is executed upon visiting the /users/2/1 page. This may allow attackers to steal Protected Health Information because the product is for...
PT-2023-19384 · Nosh · Nosh
Name of the Vulnerable Software and Affected Versions: NOSH version 4a5cfdb Description: The issue allows stored XSS via the create user page. For example, a first name of a physician, assistant, or billing user can have a JavaScript payload that is executed upon visiting the "/users/2/1" page...
CVE-2023-24065
The CVE-2023-24065 entry affects NOSH (version 4a5cfdb) and describes a stored XSS vulnerability on the create user page. A crafted first name field can execute JavaScript when visiting /users/2/1, with potential to exfiltrate Protected Health Information in a healthcare-charting context. Public ...
CVE-2023-24065
NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name of a physician, assistant, or billing user can have a JavaScript payload that is executed upon visiting the /users/2/1 page. This may allow attackers to steal Protected Health Information because the product is for...
CVE-2022-40049
SQL injection vulnerability in sourcecodester Theme Park Ticketing System 1.0 allows remote attackers to view sensitive information via the id parameter to the /tpts/manageuser.php page...
CVE-2022-40049
SQL injection vulnerability in sourcecodester Theme Park Ticketing System 1.0 allows remote attackers to view sensitive information via the id parameter to the /tpts/manageuser.php page...
PT-2023-13746 · Sourcecodester · Theme Park Ticketing System
Name of the Vulnerable Software and Affected Versions: sourcecodester Theme Park Ticketing System version 1.0 Description: The issue allows remote attackers to view sensitive information. This is achieved via the id parameter to the "/tpts/manage user.php" API endpoint. Recommendations: For...
CVE-2022-43265
An arbitrary file upload vulnerability in the component /pages/saveuser.php of Canteen Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file...
PT-2022-26819 · Unknown · Canteen Management System
Name of the Vulnerable Software and Affected Versions: Canteen Management System version 1.0 Description: The issue concerns an arbitrary file upload vulnerability in the /pages/save user.php component, allowing attackers to execute arbitrary code by uploading a crafted PHP file. Recommendations:...
CVE-2022-3549
A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /csms/admin/?page=user/manageuser of the component Avatar Handler. The manipulation leads to unrestricted upload. The...
Billing System Project SQL注入漏洞
Billing System Project is a billing system project by Mayuri K. Individual Developer. Billing System Project v1.0 has a SQL injection vulnerability that stems from the id parameter in /phpinventory/edituser.php found to contain a SQL injection vulnerability...
GSD-2022-1005366 RISC-V: Update user page mapping only once during start
RISC-V: Update user page mapping only once during start This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.2 by commit...
Kirby 跨站请求伪造漏洞
Kirby is a file-based content management system CMS. A security vulnerability exists in Kirby version 2.5.12, which can be exploited to force the deletion of a user's page by a remote attacker who can craft a malicious CSRF page that utilizes its "delete" page feature...
Cross site scripting
A vulnerability classified as problematic was found in SourceCodester Online Student Admission System. Affected by this vulnerability is an unknown functionality of the file edit-profile.php of the component Student User Page. The manipulation with the input alert/xss/ leads to cross site...
CVE-2022-32400
Prison Management System v1.0 was discovered to contain a SQL injection vulnerability via the 'id' parameter at /pms/admin/user/manageuser.php:4...
CVE-2022-33049
Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/?page=user/manageuser...
CVE-2022-32341
Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/?page=user/manageuser&id=...
CVE-2022-31345
Online Car Wash Booking System v1.0 is vulnerable to SQL Injection via /ocwbs/admin/?page=user/manageuser&id=...
GHSA-W93W-RX52-24QH MantisBT vulnerable to XSS via unsanitized filter field in manage_user_page.php
An XSS issue was discovered in manageuserpage.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled...