CVE-2019-14333

An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a pre-authenticated denial of service attack against the access point via a long action parameter to admin.cgi...

CVE-2018-20806

Phamm aka PHP LDAP Virtual Hosting Manager 0.6.8 allows XSS via the login page the /public/main.php action parameter...

CVE-2018-20806

Removed by vendor...

Code injection

JTBCPHP 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter...

The vulnerability in the FortiOS operating system’s web interface allows a hacker to inject any desired JavaScript or HTML code.

The vulnerability in the FortiOS operating system’s web interface stems from insufficient protection of the web page structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary JavaScript or HTML code during the activation of FortiToken using the “action” parameter...

CVE-2018-17062

An issue was discovered in SeaCMS 6.64. XSS exists in adminvideo.php via the action, area, type, yuyan, jqtype, visunion, vrecycled, vismoney, or vispsd parameter...

PT-2018-11065 · Amd · Adrenalin

Name of the Vulnerable Software and Affected Versions: Adrenalin version 5.4.0 Description: A Reflected Cross Site Scripting issue was discovered. The user-supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the "flexiportal/GeneralInfo.aspx" endpoint,...

SeedDMS Cross-Site Scripting Vulnerability

SeedDMS formerly known as LetoDMS and MyDMS is SeedDMS enthusiasts jointly developed a set of PHP and MySql-based open source document management system . The system is mainly used to store and share documents. A cross-site scripting vulnerability exists in SeedDMS versions prior to 5.1.8 on page...

CVE-2018-12943

Cross-Site Scripting XSS vulnerability in every page that includes the "action" URL parameter in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

Cross site scripting

Cross-Site Scripting XSS vulnerability in every page that includes the "action" URL parameter in SeedDMS formerly LetoDMS and MyDMS before 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15620)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the customer portal changeManageBtn method in Quest DR Series disk backup software before 4.0.3.1. An attacker can exploit this vulnerability to execute commands via the 'action' paramet...

CVE-2018-6362

Easy Hosting Control Panel EHCP v0.37.12.b has XSS via the domainop action parameter, as demonstrated by reading the PHPSESSID cookie...

CVE-2018-6362

EHCP (Easy Hosting Control Panel) version 0.37.12.b is affected by a Cross-Site Scripting vulnerability in the domainop action parameter. The vulnerability allows a crafted request to execute script in a user’s browser and, as demonstrated in public advisories, can lead to reading the PHPSESSID c...

CVE-2018-10314

Cross-site scripting XSS vulnerability in Open-AudIT Community 2.2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted name of a component, as demonstrated by the action parameter in the Discover - Audit Scripts - List Scripts - Download section...

Discuz! DiscuzX Security Bypass Vulnerability (CNVD-2018-02844)

Discuz! DiscuzX is an online forum system. A security bypass vulnerability exists in Discuz! DiscuzX X3.4. A remote attacker can exploit this vulnerability by sending the 'action' parameter to the archiver\index.php file to bypass access restrictions...

CVE-2018-5377

Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via the archiver\index.php action parameter...

CVE-2017-16950

Cross - site scripting XSS vulnerability in UrBackup Server before 2.1.20 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

Cross site scripting

Cross - site scripting XSS vulnerability in UrBackup Server before 2.1.20 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2017-16950

Cross - site scripting XSS vulnerability in UrBackup Server before 2.1.20 allows remote attackers to inject arbitrary web script or HTML via the action parameter...

CVE-2017-14622

Multiple cross-site scripting XSS vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter or 2 kbAction parameter in the kbAmz page to wp-admin/admin.php...