CVE-2023-36652

A SQL Injection in the users searching REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to read database data via SQL commands injected in the search parameter...

phpIPAM Injection Vulnerability

phpIPAM is an open source PHP and MySQL based IP address management application IPAM. An injection vulnerability exists in versions prior to Phpipam v1.5.2, which stems from the dname parameter in /users/ad-search-result.php containing an LDAP injection vulnerability that allows an attacker to...

Error "Try again after some time or contact your help desk" after authentication passed

After inputting your username and password to "https://x.x.x.x/manageotp" page, you are encountering an error message that says, "Try again after some time or contact your help desk " "Rejecting with error code 4009 “， ”receiveldapusersearchevent:ldapfirstentryreturned null, user XXX not found “...

PT-2023-26183 · Kubepi · Kubepi

Name of the Vulnerable Software and Affected Versions: KubePi versions prior to 1.6.5 Description: The issue concerns the leakage of password hashes for any user, including administrators, through the /kubepi/api/v1/users/search endpoint. This could allow a motivated attacker to crack the leaked...

WordPress Admin User Search Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

Software Admin User Search Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID baed34e044d2 Credits Rafie Muhammad Patchstack Requir...

CVE-2023-35927

The CVE-2023-35927 issue affects Nextcloud Server and Enterprise Server where two trusted servers exchange share secrets and an attacker could modify or delete VCards in the origin server’s system address book, impacting user search and avatar menus. The initial description lists affected lines f...

PT-2023-8431 · Nextcloud +2 · Nextcloud Enterprise Server +3

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions 25.0.0 through 25.0.7 Nextcloud Server versions 26.0.0 through 26.0.2 Nextcloud Enterprise Server versions 21.0.0 through 21.0.9.12 Nextcloud Enterprise Server versions 22.0.0 through 22.2.10.12 Nextcloud Enterprise...

CVE-2022-40487

ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting XSS vulnerabilities via the Search Users and Search Pages function. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via injection of a crafted payload...

Reflected XSS in Username

Description If a regular user's username is set to a XSS payload, and then that same XSS payload is placed in the q query parameter of /scp/ajax.php/users/local, then reflected XSS is achieved. This XSS can lead to complete takeover of the osTicket instance. Proof of Concept Set a user's username...

Joplin Vulnerable to Code Injection

Joplin prior to version 2.7.1 allows remote attackers to execute system commands through malicious code in user search results...

Design/Logic Flaw

Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results...

CVE-2022-23340

Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results...

Usoc SQL注入漏洞

Usoc is a useful and simple open source Cms from the individual developer Aaron Junker in Switzerland. A security vulnerability exists in Usoc, which stems from the fact that versions prior to Pb2.4Bfx3 only allow users with administrative privileges to perform Sql injection in usersearch.php...

Cross site scripting

Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html/directory-search user search page via the e-mail address field...

CVE-2021-27956

Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html/directory-search user search page via the e-mail address field...

CVE-2020-35151

The Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php request is vulnerable to Time Based Sql Injection...

Sql injection

The Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php request is vulnerable to Time Based Sql Injection...

CVE-2020-35151

The Online Marriage Registration System 1.0 post parameter "searchdata" in the user/search.php request is vulnerable to Time Based Sql Injection...

PT-2020-17269 · Unknown · The Online Marriage Registration System

Name of the Vulnerable Software and Affected Versions: The Online Marriage Registration System version 1.0 Description: The issue concerns a Time Based Sql Injection vulnerability in the searchdata post parameter of the "user/search.php" request. This vulnerability allows for potential...

iSmartgate PRO Cross-Site Request Forgery Vulnerability (CNVD-2021-01047)

The iSmartgate PRO is a smart garage door opening system. A cross-site request forgery vulnerability exists in iSmartgate PRO 1.5.9. An attacker can exploit this vulnerability to conduct a cross-site request forgery attack via the busca parameter in a form used to search for users...