Sql injection

Money Transfer Management System 1.0 is vulnerable to SQL Injection via /mtms/classes/Users.php?f=delete...

CVE-2022-29981

Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/classes/Users.php?f=delete...

CVE-2022-28410

Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Users.php?f=deleteagent...

Sql injection

Simple Real Estate Portal System v1.0 was discovered to contain a SQL injection vulnerability via /reps/classes/Users.php?f=deleteagent...

CVE-2022-26293

Online Project Time Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the function saveemployee at /ptms/classes/Users.php...

Sql injection

Online Project Time Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the function saveemployee at /ptms/classes/Users.php...

CVE-2022-26293

Online Project Time Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the function saveemployee at /ptms/classes/Users.php...

Victor CMS users.php SQL注入漏洞

Victor CMS is an open source content management system from the individual developers of Victor Alagwu in Nigeria. victor CMS has a SQL injection vulnerability in v1.0, which stems from the lack of validation of externally entered SQL statements in database-based applications. An attacker could...

CVE-2021-46459

Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=adduser. These vulnerabilities can be exploited through a crafted POST request via the username, userfirstname,userlastname, or useremail parameters...

CVE-2021-46459

Victor CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the component admin/users.php?source=adduser. These vulnerabilities can be exploited through a crafted POST request via the username, userfirstname,userlastname, or useremail parameters...

CVE-2021-46459

CVE-2021-46459 affects Victor CMS v1.0. Multiple SQL injection vulnerabilities exist in the admin/users.php?source=add_user component, exploitable via crafted POST requests to parameters user_name, user_firstname, user_lastname, or user_email. Root cause stated: lack of input validation in SQL st...

CVE-2021-44949

glFusion CMS 1.7.9 is affected by an access control vulnerability via /publichtml/users.php...

Improper access control

glFusion CMS 1.7.9 is affected by an access control vulnerability via /publichtml/users.php...

CVE-2021-44937

glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /publichtml/users.php. An attacker can register with the mailbox of any user. When users want to register, they will find that the mailbox has been occupied...

CVE-2021-44937

glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /publichtml/users.php. An attacker can register with the mailbox of any user. When users want to register, they will find that the mailbox has been occupied...

GlFusion Cms 授权问题漏洞

GlFusion Cms is a content management and publishing system. glFusion CMS v1.7.9 is vulnerable to an authorization issue, which can be exploited by attackers via /publichtml/users.php...

CVE-2021-40261

Multiple Cross Site Scripting XSS vulnerabilities exist in SourceCodester CASAP Automated Enrollment System 1.0 via the 1 userusername and 2 category parameters in saveclass.php, the 3 firstname, 4 class, and 5 status parameters in studenttable.php, the 6 category and 7 classname parameters in...

miniOrange's Google Authenticator < 5.4.40 - Reflected Cross-Site Scripting

The plugin does not escape the user parameter before outputting it back in an attribute in the dashboard page to confirm the 2FA reset, leading to a Reflected Cross-Site Scripting issue https://example.com/wp-admin/users.php?page=reset&action=resetedit&user="alert/XSS/...

CVE-2021-3294

CVE-2021-3294 concerns the CASAP Automated Enrollment System 1.0. The vulnerability is a Stored Cross-Site Scripting (XSS) in users.php, arising from insufficient validation of user data in the “First Name” field, enabling an attacker to steal cookies and redirect victims to a malicious site. Pub...

Nagios XI users.php do_update_user Stored Cross-Site Scripting

A stored cross-site scripting vulnerability exists in Nagios XI. The vulnerability is due to insufficient validation of the phone parameter in users.php...