CVE-2021-41408

CVE-2021-41408 concerns VoIPmonitor WEB GUI (up to 24.61). The vulnerability is a SQL injection through the api.php endpoint via the user parameter, caused by missing input filtering/escaping. Exploitation could allow an attacker to execute arbitrary SQL commands and access stolen data, as indica...

CVE-2021-41408: Improper Neutralization of Special Elements used in an SQL Command

VoIPmonitor WEB GUI up to version 24.61 is affected by SQL injection through the "api.php" file and "user" parameter...

CVE-2021-45839: Undefined Security Weakness

It is possible to obtain the first administrator's hash set up on the system in Terramaster F4-210, F2-210 TOS 4.2.X 4.2.15-2107141517 as well as other information such as MAC address, internal IP address etc. by performing a request to the /module/api.php?mobile/webNasIPS endpoint...

CVE-2021-45842: Undefined Security Weakness

It is possible to obtain the first administrator's hash set up in Terramaster F4-210, F2-210 TOS 4.2.X 4.2.15-2107141517 on the system as well as other information such as MAC address, internal IP address etc. by performing a request to the /module/api.php?mobile/wapNasIPS endpoint...

Cross-Site Request Forgery (CSRF)

microweber/microweber is vulnerable to cross-site request forgeryCSRF. The vulnerability exists due to a lack of input sanitization in the api.php file allowing the attacker to manipulate authorized users to initiate unwanted actions...

CVE-2021-43679

ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php...

CVE-2021-43679

ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php...

Sql injection

ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php...

Cross site scripting

nZEDb v0.4.20 is affected by a Cross Site Scripting XSS vulnerability in www/pages/api.php. The exit function will terminate the script and print the message which has the input $GET't'...

CVE-2021-43686

nZEDb v0.4.20 is affected by a Cross Site Scripting XSS vulnerability in www/pages/api.php. The exit function will terminate the script and print the message which has the input $GET't'...

CVE-2021-43686: Improper Neutralization of Input During Web Page Generation

nZEDb v0.4.20 is affected by a Cross Site Scripting XSS vulnerability in www/pages/api.php. The exit function will terminate the script and print the message which has the input $GET't'...

CVE-2021-43679: Improper Neutralization of Special Elements used in an SQL Command

ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php...

in hascheksolutions/opentrashmail

✍️ Description Attackers can control the filesystem path argument to readfile at api.php line 35 for ?email= parameter, which allows them to access or modify otherwise protected files. Analysis Trace: 1. application take unsensitized input at: $email = strtolower$REQUEST'email'; 2. Assigning user...

CVE-2020-21998

In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted o...

Design/Logic Flaw

In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted o...

PT-2021-10713

Name of the Vulnerable Software and Affected Versions HomeAutomation version 3.3.2 Description The issue arises from improper verification of input passed via the redirect GET parameter in the "api.php" script. This can be exploited to redirect a user to an arbitrary website, for example, when a...

CVE-2020-21998: URL Redirection to Untrusted Site

In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted o...

CVE-2020-6577: Improper Neutralization of Special Elements used in an SQL Command

The IT-Recht Kanzlei plugin in Zen Cart 1.5.6c German edition allows itrk-api.php rechtstextlanguage SQL Injection...

CVE-2020-16629

PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data through SQL, and then call the attachment replacement function through api.php to write a PHP file to the target path...

Sql injection

PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data through SQL, and then call the attachment replacement function through api.php to write a PHP file to the target path...