6115 matches found
CVE-2020-8826
As of v1.5.0, the Argo web interface authentication system issued immutable tokens. Authentication tokens, once issued, were usable forever without expiration—there was no refresh or forced re-authentication...
CVE-2020-26041
An issue was discovered in Hoosk CmS v1.8.0. There is an Remote Code Execution vulnerability in install/index.php...
CVE-2020-19889
DBHcms v1.2.0 has no CSRF protection mechanism,as demonstrated by CSRF for index.php?dbhcmspid=-70 can add a user...
CVE-2020-18454
Cross Site Request Forgery CSRF vulnerability in bycms v1.3 via admin.php/systems/index/moduleid/70/groupid/1.html...
CVE-2020-25005
Heybbs v1.2 has a SQL injection vulnerability in msg.php file via the ID parameter which may allow a remote attacker to execute arbitrary code...
CVE-2020-19107
SQL Injection vulnerability in Online Book Store v1.0 via the isbn parameter to editbook.php, which could let a remote malicious user execute arbitrary code...
CVE-2020-23136
Microweber v1.1.18 is affected by no session expiry after log-out...
CVE-2020-20340
A SQL injection vulnerability in the 4.edu.php\conn\function.php component of S-CMS v1.0 allows attackers to access sensitive database information...
CVE-2020-18106
The GET parameter "id" in WMS v1.0 is passed without filtering, which allows attackers to perform SQL injection...
CVE-2020-20662
libieciccpmod v1.5 contains a heap-buffer-overflow in the component mmsclientexample1.c...
CVE-2020-6622
stb stbtruetype.h through 1.22 has a heap-based buffer over-read in stbttbufpeek8...
CVE-2020-25004
Heybbs v1.2 has a SQL injection vulnerability in user.php file via the ID parameter which may allow a remote attacker to execute arbitrary code...
CVE-2019-9145
An issue was discovered in Hsycms V1.1. There is an XSS vulnerability via the name field to the /book page...
CVE-2019-6965
An XSS issue was discovered in i-doit Open 1.12 via the src/tools/php/qr/qr.php url parameter...
CVE-2019-13651
TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow portMappingProtocol OS Command Injection issue 3 of 5...
CVE-2017-15947
Simple ASC Content Management System v1.2 has XSS in the location field in the sign function, related to guestbook.asp, formgb.asp, and msggb.asp...
CVE-2017-14715
In EPESI 1.8.2 rev20170830, there is Stored XSS in the Tasks Alerts Title parameter...
CVE-2019-20089
GoPro GPMF-parser 1.2.3 has an heap-based buffer over-read in GPMFSeekToSamples in GPMFparse.c for the size calculation...