578 matches found
CVE-2018-16139: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in BIBLIOsoft BIBLIOpac 2008 allows remote attackers to inject arbitrary web script or HTML via the db or action parameter to to bin/wxis.exe/bibliopac/...
PT-2019-12426
Name of the Vulnerable Software and Affected Versions doorGets version 7.0 Description The issue is related to a SQL injection vulnerability in the /doorgets/app/requests/user/configurationRequest.php endpoint when the action parameter is set to analytics. This could allow a remote background...
CVE-2018-20806
Phamm aka PHP LDAP Virtual Hosting Manager 0.6.8 allows XSS via the login page the /public/main.php action parameter...
CVE-2018-20806
Phamm aka PHP LDAP Virtual Hosting Manager 0.6.8 allows XSS via the login page the /public/main.php action parameter...
CVE-2018-20806
Removed by vendor...
CVE-2018-20806: Improper Neutralization of Input During Web Page Generation
Phamm aka PHP LDAP Virtual Hosting Manager 0.6.8 allows XSS via the login page the /public/main.php action parameter...
PT-2018-15167
Name of the Vulnerable Software and Affected Versions Sales & Company Management System SCMS versions prior to 2018-06-06 Description An issue was discovered in the system, where there is a CSRF vulnerability in the member email.php file, specifically when the action parameter is set to edit...
Code injection
JTBCPHP 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter...
PT-2018-14657
Name of the Vulnerable Software and Affected Versions School Event Management System version 1.0 Description The issue allows for Arbitrary File Upload. This can be achieved via the "event/controller.php?action=photos" endpoint, specifically by exploiting the action parameter set to photos...
The vulnerability in the FortiOS operating system’s web interface allows a hacker to inject any desired JavaScript or HTML code.
The vulnerability in the FortiOS operating system’s web interface stems from insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary JavaScript or HTML code during the activation of FortiToken using the “action” parameter...
CVE-2018-17062
An issue was discovered in SeaCMS 6.64. XSS exists in adminvideo.php via the action, area, type, yuyan, jqtype, visunion, vrecycled, vismoney, or vispsd parameter...
PT-2018-11065
Name of the Vulnerable Software and Affected Versions Adrenalin version 5.4.0 Description A Reflected Cross Site Scripting issue was discovered. The user-supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the "flexiportal/GeneralInfo.aspx" endpoint,...
PT-2018-12840
Name of the Vulnerable Software and Affected Versions zzcms version 8.3 Description The issue is related to a CSRF problem. It affects the admin/adminadd.php endpoint, specifically when the action parameter is set to add. Recommendations For zzcms version 8.3, consider implementing proper CSRF...
SeedDMS Cross-Site Scripting Vulnerability
SeedDMS formerly known as LetoDMS and MyDMS is SeedDMS enthusiasts jointly developed a set of PHP and MySql-based open source document management system . The system is mainly used to store and share documents. A cross-site scripting vulnerability exists in SeedDMS versions prior to 5.1.8 on page...
CVE-2018-12943
Cross-Site Scripting XSS vulnerability in every page that includes the "action" URL parameter in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter...
Cross site scripting
Cross-Site Scripting XSS vulnerability in every page that includes the "action" URL parameter in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter...
PT-2018-11499
Name of the Vulnerable Software and Affected Versions SeedDMS versions prior to 5.1.8 Description A Cross-Site Scripting XSS issue exists in every page that includes the "action" URL parameter, allowing remote attackers to inject arbitrary web script or HTML via the action parameter...
CVE-2018-12943: Improper Neutralization of Input During Web Page Generation
Cross-Site Scripting XSS vulnerability in every page that includes the "action" URL parameter in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter...
Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15620)
The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the customer portal changeManageBtn method in Quest DR Series disk backup software before 4.0.3.1. An attacker can exploit this vulnerability to execute commands via the 'action' paramet...