2456 matches found
CVE-2019-7719
Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then making a content/private/shadow.php request...
Design/Logic Flaw
Nibbleblog 4.0.5 allows eval injection by placing PHP code in the install.php username parameter and then making a content/private/shadow.php request...
CVE-2019-7567
An issue was discovered in Waimai Super Cms 20150505. admin.php?m=Member&a=adminaddsave has XSS via the username or password parameter...
DEBIAN-CVE-2019-7348
Self - Stored Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'username' parameter value in the view user user.php because proper filtration is omitted...
UBUNTU-CVE-2019-7348
Self - Stored Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'username' parameter value in the view user user.php because proper filtration is omitted...
PT-2019-18553 · Zoneminder +1 · Zoneminder +1
Name of the Vulnerable Software and Affected Versions: ZoneMinder versions prior to 1.32.3 Description: The issue allows an attacker to execute HTML or JavaScript code via a vulnerable username parameter value in the user view user.php due to omitted proper filtration, leading to a persistent...
CVE-2019-6497
HotelsServer through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter...
CVE-2019-6497
HotelsServer through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter...
Sql injection
HotelsServer through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter...
CVE-2019-6497
Technical details about CVE-2019-6497 are not publicly provided in the supplied documents. Monitor for updates from vendors and CERT/NSCs for affected products, versions, and fix information.
CVE-2018-19414
Multiple cross-site scripting XSS vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to inject arbitrary web script or HTML via the 1 keyword parameter to groups.php; 2 username parameter to login.php; or 3 date parameter to search.php...
CVE-2018-19414
Multiple cross-site scripting XSS vulnerabilities in Plikli CMS 4.0.0 allow remote attackers to inject arbitrary web script or HTML via the 1 keyword parameter to groups.php; 2 username parameter to login.php; or 3 date parameter to search.php...
Drobo 5N2 cross-site scripting vulnerability (CNVD-2019-05932)
The Drobo 5N2 NAS is a networked storage appliance NAS from Drobo, USA. The device features data sharing, data backup, remote access and disaster recovery. A cross-site scripting vulnerability exists in the /DroboAccess/deleteuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115. A remote...
Drobo 5N2 cross-site scripting vulnerability (CNVD-2019-05931)
The Drobo 5N2 NAS is a networked storage appliance NAS from Drobo, USA. The device features data sharing, data backup, remote access and disaster recovery. A cross-site scripting vulnerability exists in the /DroboAccess/enableuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115. A remote...
Drobo 5N2 System Command Injection Vulnerability (CNVD-2019-05916)
The Drobo 5N2 NAS is a networked storage appliance NAS from Drobo, USA. The device features data sharing, data backup, remote access and disaster recovery. A command injection vulnerability exists in the /DroboAccess/deleteuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115. An attacker can...
Cross site scripting
Cross-site scripting in the /DroboAccess/enableuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the username URL parameter...
CVE-2018-14698
Cross-site scripting in the /DroboAccess/deleteuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows attackers to execute JavaScript via the "username" URL parameter...
CVE-2018-14699
System command injection in the /DroboAccess/enableuser endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to execute system commands via the "username" URL parameter...