116 matches found
Sql injection
iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter...
CVE-2018-11372
iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter...
CVE-2018-11373
iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter...
CVE-2018-11373
iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter...
CVE-2018-11372
iScripts eSwap v2.4 has SQL injection via the wishlistdetailed.php User Panel ToId parameter...
CVE-2018-11373
The CVE-2018-11373 entry concerns iScripts eSwap v2.4, where a SQL injection exists in the salelistdetailed.php User Panel ToId parameter. The root cause appears to be improper handling of user-supplied ToId leading to database query manipulation. Multiple connected sources (CNVD-2018-15242, RH: ...
CVE-2018-11372
CVE-2018-11372 affects iScripts eSwap v2.4. The issue is an SQL injection in the Wishlistdetailed.php User Panel ToId parameter, caused by unsafe handling of the ToId input. The vulnerability can enable attackers to view, add, modify, or delete data in the backend database (as described across mu...
CVE-2018-11373: Improper Neutralization of Special Elements used in an SQL Command
iScripts eSwap v2.4 has SQL injection via the "salelistdetailed.php" User Panel ToId parameter...
iScripts eSwap cross-site scripting vulnerability (CNVD-2018-07983)
IScripts eSwap is an item trading program from IScripts Inc. that supports the use of virtual currency or direct item exchange. The program supports the use of virtual currencies for trading or direct item exchange.User Panel is one of the user panels. A cross-site scripting vulnerability exists ...
Cross site scripting
iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel...
CVE-2018-10135
iScripts eSwap v2.4 contains a Reflected Cross-Site Scripting (XSS) vulnerability in the User Panel, exploitable via the catid parameter of catwiseproducts.php. The root cause is the lack of input sanitization/reflection of user-controlled data in server responses, enabling injection of arbitrary...
CVE-2018-10135
iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel...
CVE-2018-10135: Improper Neutralization of Input During Web Page Generation
iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel...
PT-2018-9702
Name of the Vulnerable Software and Affected Versions: iScripts eSwap version 2.4 Description: The issue is related to Reflected XSS, which occurs via the catid parameter in the "catwiseproducts.php" file within the User Panel. Recommendations: For iScripts eSwap version 2.4, consider restricting...
PHP Scripts Mall Single Theater Booking Cross-Site Request Forgery Vulnerability
PHP Scripts Mall Single Theater Booking is an open source theater script. A cross-site request forgery vulnerability exists in PHP Scripts Mall Single Theater Booking. A remote attacker can use the admin/sitesettings.php file to change sensitive settings on the user panel, or even inject web scri...
CVE-2017-17903
FS Lynda Clone has CSRF via user/editprofile, as demonstrated by adding content to the user panel...
Cross site request forgery (csrf)
FS Lynda Clone has CSRF via user/editprofile, as demonstrated by adding content to the user panel...
CVE-2017-17930: Cross-Site Request Forgery (CSRF)
PHP Scripts Mall Professional Service Script has CSRF via admin/generalsettingupd.php, as demonstrated by modifying a setting in the user panel...
CVE-2017-17930
The affected software is PHP Scripts Mall Professional Service Script. It contains a Cross-Site Request Forgery (CSRF) vulnerability exploitable via admin/general_settingupd.php, demonstrated by changing a setting in the user panel. The root cause and specific impact details are described across ...
Bitcoin / Dogecoin Mining 1.0 SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Bitcoin,Dogecoin Mining 1.0 - Authentication Bypass Dork: N/A Date: 21.08.2017 Vendor Homepage: https://codecanyon.net/user/bousague Software Link: https://codecanyon.net/item/bitcoindogecoin-mining-php-script/20315581 Demo:...