CVE-2020-20474

White Shark System WSS 1.3.2 has a SQL injection vulnerability. The vulnerability stems from the defaulttaskedituser.php files failing to filter the csatouser parameter. Remote attackers can exploit the vulnerability to obtain database sensitive information...

Default configuration

Orbit Fox by ThemeIsle has a feature to add a registration form to both the Elementor and Beaver Builder page builders functionality. As part of the registration form, administrators can choose which role to set as the default for users upon registration. This field is hidden from view for...

CVE-2020-23517: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in Aryanic HighMail High CMS versions 2020 and before allows remote attackers to inject arbitrary web script or HTML, via 'user' to LoginForm...

CVE-2020-35741

HGiga MailSherlock contains a cross-site scripting (XSS) vulnerability: it does not validate user parameters on multiple login pages, allowing an attacker to inject JavaScript syntax. The CVE entry CVE-2020-35741 is documented across multiple sources (NVD and CNVD) with this behavior. Impact deta...

CVE-2020-35729

KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter...

KLog Server OS Command Injection Vulnerability

KLog is ZhaoKaiQiang KLog individual developers of a logging tool for Android development . The tool's main functions are to print line numbers, function calls, Json parsing, XML parsing, click to jump, Log information saved and other functions. KLog Server 2.4.1 suffers from an OS command...

CVE-2020-35729: Improper Neutralization of Special Elements used in an OS Command

KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter...

PT-2020-14551 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to disclose sensitive information on affected installations without requiring authentication. The flaw exists within the ajax mail autoreply.php file,...

PT-2020-14429 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version cwp-e17.0.9.8.923 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the ajax crons.php...

Cross-Site Scripting Vulnerability in Multiple Cambium Networks Products

The Cambium Networks Xirrus XR520, among others, is a wireless access point device from Cambium Networks, USA. A cross-site scripting vulnerability exists in the 'user' parameter of the cgi-bin/ViewPage.cgi file in multiple Cambium Networks products. The vulnerability stems from a lack of proper...

Cross site scripting

An issue was discovered on Xirrus XR520, XR620, XR2436, and XH2-120 devices. The cgi-bin/ViewPage.cgi user parameter allows XSS...

CVE-2020-8592

The CVE-2020-8592 entry concerns eG Manager 7.1.2, where the Forgot Password path (com.eg.LoginHelperServlet) is vulnerable to SQL Injection via the user parameter. The NVD entry cites a high/critical impact with CVSS v3.1: Network, LOW attack complexity, no privileges required, and high confiden...

CVE-2019-1010123

MODX Revolution Gallery 1.7.0 is affected by: CWE-434: Unrestricted Upload of File with Dangerous Type. The impact is: Creating file with custom a filename and content. The component is: Filtering user parameters before passing them into phpthumb class. The attack vector is: web request via...

CVE-2019-13346

In MyT 1.5.1, the Userusername parameter has XSS...

Cross site scripting

In MyT 1.5.1, the Userusername parameter has XSS...

CVE-2019-13346

In MyT 1.5.1, the Userusername parameter has XSS...

CVE-2014-9917

An issue was discovered in Bilboplanet 2.0. There is a stored XSS vulnerability when adding a tag via the user/?page=tribes tags parameter...

CVE-2017-18364

phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter...

CVE-2019-9661

Stored XSS exists in YzmCMS 5.2 via the admin/systemmanage/userconfigedit.html "value" parameter,...

CVE-2018-1000833

ZoneMinder version = 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data, denial of service, SSRF, remote code execution...