537 matches found
CVE-2021-33948
SQL injection vulnerability in FantasticLBP Hotels Server v1.0 allows attacker to execute arbitrary code via the username parameter...
CVE-2020-35729
KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter...
CVE-2019-17120
A stored and reflected cross-site scripting XSS vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/admusrs.jsp. The usr parameter is vulnerable: the reflected cross-site scripting occurs immediately after...
CVE-2013-0730
Multiple cross-site scripting XSS vulnerabilities in Newscoop 4.x through 4.1.0 allow remote attackers to inject arbitrary web script or HTML via vectors involving the 1 language parameter to application/modules/admin/controllers/LanguagesController.php or 2 user parameter to...
CVE-2019-13346
In MyT 1.5.1, the Userusername parameter has XSS...
CVE-2018-20369
Barracuda Message Archiver 2018 has XSS in the errormsg exception-handling value for the ldapuser parameter to the cgi-mod/ldaploadentry.cgi module. The injection point of the issue is the AddUpdate module...
CVE-2025-40624
SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ and...
CVE-2025-40624
SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’ and...
CVE-2025-40620
SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information in the database. This vulnerability was found in each of the following parameters according to the vulnerability identifier ‘User’...
CVE-2025-2011
The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including, 3.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...
Tcman Gim SQL注入漏洞
Tcman Gim is a facility management software from the Spanish company Tcman designed for use on mobile devices. A SQL injection vulnerability exists in Tcman Gim version v11, which stems from an SQL injection in the ValidateUserAndGetData endpoint User parameter...
CVE-2025-4204
CVE-2025-4204: Ultimate Auction Pro for WordPress (
JSite 安全漏洞
JSite is JSite open source a backend management system rapid development framework . JSite 1.0 version has a security vulnerability , the vulnerability stems from the file /a/sys/user/save in the parameter Name operation leads to cross-site scripting attacks...
CVE-2025-3575 Insecure Direct Object Reference en Deporsite de T-INNOVA
Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/establecerUsuarioSeleccion" endpoint...
CVE-2025-3574 Insecure Direct Object Reference on Deporsite by T-INNOVA
Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/obtenerFamiliaUsuario" endpoint...
CVE-2025-1321
The teachPress plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tpsearch' shortcode in all versions up to, and including, 9.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...
CVE-2025-1572
The CVE-2025-1572 entry concerns KiviCare – Clinic & Patient Management System (EHR) WordPress plugin (versions
Palantir Foundry 安全漏洞
Palantir Foundry is a business process management platform from US-based Palantir, Inc. A security vulnerability exists in Palantir Foundry versions prior to 0.1337.0 that originates from a disk exhaustion due to a user parameter that could trigger a denial of service...
Chat System addnewmember.php File SQL Injection Vulnerability
Chat System is a chat system. Chat System has a SQL injection vulnerability that stems from a lack of sufficient input validation and cleanup of the parameter user in the file /user/addnewmember.php. An attacker could exploit this vulnerability to cause database information to be disclosed or...