CVE-2021-39426

An issue was discovered in /Upload/admin/adminnotify.php in Seacms 11.4 allows attackers to execute arbitrary php code via the notify1 parameter when the action parameter equals set...

CVE-2021-39426: Improper Control of Generation of Code

An issue was discovered in /Upload/admin/adminnotify.php in Seacms 11.4 allows attackers to execute arbitrary php code via the notify1 parameter when the action parameter equals set...

CVE-2022-28607

An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive information via the action parameter to /system/user/modules/modusers/controller.php...

ISIC 安全漏洞

ISIC is a web backend for asith-eranga individual developers. A security vulnerability exists in ISIC tour booking that stems from allowing an attacker to obtain sensitive information via the action parameter in /system/user/modules/modusers/controller.php...

CVE-2022-28607

An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive information via the action parameter to /system/user/modules/modusers/controller.php...

CVE-2022-28607: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive information via the action parameter to /system/user/modules/modusers/controller.php...

CVE-2022-28607

An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive information via the action parameter to /system/user/modules/modusers/controller.php...

The vulnerability of the implementation of the DefaultActionMapper mechanism in the Apache Struts software platform allows a perpetrator to execute arbitrary code.

The vulnerability of the DefaultActionMapper mechanism implemented by the Apache Struts software platform is related to insufficient cleaning of input data when processing parameters such as action:, redirect:, and redirectAction: prefix. Exploiting this vulnerability allows an attacker to execut...

CVE-2022-40912

ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting XSS. Input passed to the GET parameter 'action' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser session in...

CVE-2022-40912: Improper Neutralization of Input During Web Page Generation

ETAP Lighting International NV ETAP Safety Manager 1.0.0.32 is vulnerable to Cross Site Scripting XSS. Input passed to the GET parameter 'action' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML/JS code in a user's browser session in...

PT-2022-23864 · Cuppacms · Cuppacms

Name of the Vulnerable Software and Affected Versions: CuppaCMS version 1.0 Description: The issue allows an authenticated user to execute remote code, providing control over certain parameters. Specifically, the /api/index.php API endpoint is affected, where an attacker can manipulate the action...

PT-2022-24320 · Unknown · Interview Management System

Name of the Vulnerable Software and Affected Versions: Interview Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the /interview/delete.php component, specifically through the action and id parameters. Recommendations: For...

Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the action parameter. An attacker can inject arbitrary web script or HTML by crafting a malicious action parameter value. Details Cross-site scripting or XSS is a...

MantisBT XSS via adm_config_report.php's action parameter

A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2...

GHSA-V7QF-22RW-CHPH MantisBT XSS via adm_config_report.php's action parameter

A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2...

PT-2022-19014

Name of the Vulnerable Software and Affected Versions Baby Care System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the "/admin/posts.php&action=delete" endpoint. The action parameter in this endpoint is vulnerable to SQL...

CVE-2022-26267

Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenanceactions.php...

CVE-2022-26267

Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenanceactions.php...

CVE-2022-26267

CVE-2022-26267 affects Piwigo v12.2.0, with an information leak via the action parameter in /admin/maintenance_actions.php. The available connected records consistently describe Piwigo 12.2.0 as vulnerable to information disclosure through this endpoint; no exploit details or affected versions be...

PT-2022-17753 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: Piwigo version 12.2.0 Description: The issue is related to an information leak in Piwigo. This leak occurs via the action parameter in the "/admin/maintenance actions.php" API endpoint. Recommendations: For Piwigo version 12.2.0, as a tempora...