217 matches found
CVE-2020-16629: Improper Neutralization of Special Elements used in an SQL Command
PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data through SQL, and then call the attachment replacement function through api.php to write a PHP file to the target path...
CVE-2020-12051: Undefined Security Weakness
The CentralAuth extension through REL134 for MediaWiki allows remote attackers to obtain sensitive hidden account information via an api.php?action=query&meta=globaluserinfo&guiuser= request. In other words, the information can be retrieved via the action API even though access would be denied wh...
CVE-2018-16356
An issue was discovered in PbootCMS. There is a SQL injection via the api.php/List/index order parameter...
Sql injection
An issue was discovered in PbootCMS. There is a SQL injection via the api.php/Cms/search order parameter...
Sql injection
An issue was discovered in PbootCMS. There is a SQL injection via the api.php/List/index order parameter...
CVE-2018-16357
An issue was discovered in PbootCMS. There is a SQL injection via the api.php/Cms/search order parameter...
CVE-2018-16357
The CVE-2018-16357 entry concerns PbootCMS and a SQL injection vulnerability exposed through the api.php/Cms/search order parameter. The NVD entry documents a SQL injection path in PbootCMS, with CVSS v3.1 impact scores: {C:H, I:H, A:H} and a base score of 9.8 (CRITICAL) and CVSS v2 base score 7....
CVE-2018-16356
An issue was discovered in PbootCMS. There is a SQL injection via the api.php/List/index order parameter...
CVE-2018-16356: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in PbootCMS. There is a SQL injection via the api.php/List/index order parameter...
CVE-2018-16357: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in PbootCMS. There is a SQL injection via the api.php/Cms/search order parameter...
MediaWiki Reflected Cross-Site Scripting (CVE-2017-8809)
A reflected cross-site scripting vulnerability exists in MediaWiki. The vulnerability is due to insufficient input validation on user input in the api.php component. A remote user can exploit this vulnerability by enticing a user to click on a malicious link...
CVE-2013-4303: Improper Neutralization of Input During Web Page Generation
includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." period characters in a string, which allows remote attackers to conduct cross-site...
CVE-2013-1817
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information...
CVE-2013-1817
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information...
CVE-2013-1817
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information...
CVE-2013-1817
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information...
CVE-2013-1817: Exposure of Sensitive Information to an Unauthorized Actor
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information...
Cross site scripting
An XSS issue was discovered in app/search/search.app.php in idreamsoft iCMS 7.0.14 via the public/api.php?app=search q parameter...
CVE-2019-11427
The CVE-2019-11427 entry concerns an XSS vulnerability in idreamsoft iCMS 7.0.14, exploitable via the public/api.php?app=search&q parameter within the file app/search/search.app.php. Connected sources consistently describe the issue as a Cross-Site Scripting vulnerability in iCMS 7.0.14, with no ...
CVE-2019-11427: Improper Neutralization of Input During Web Page Generation
An XSS issue was discovered in app/search/search.app.php in idreamsoft iCMS 7.0.14 via the public/api.php?app=search q parameter...