CVE-2022-48324: Improper Neutralization of Input During Web Page Generation

Multiple Cross Site Scripting XSS vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: 1 pesquisa, 2 data, 3 data2, 4 nome, 5 descricao, 6 idDocumentos, 7 id in file application/controllers/Arquivos.php; 8 senha, 9 nomeCliente, 10 contato, 1...

CVE-2022-48325: Improper Neutralization of Input During Web Page Generation

Multiple Cross Site Scripting XSS vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: 1 year, 2 oldSenha, 3 novaSenha, 4 termo, 5 nome, 6 cnpj, 7 ie, 8 cep, 9 logradouro, 10 numero, 11 bairro, 12 cidade, 13 uf, 14 telefone, 15 email, 16 id,...

CVE-2022-48326: Improper Neutralization of Input During Web Page Generation

Multiple Cross Site Scripting XSS vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: 1 nome, 2 aCliente, 3 eCliente, 4 dCliente, 5 vCliente, 6 aProduto, 7 eProduto, 8 dProduto, 9 vProduto, 10 aServico, 11 eServico, 12 dServico, 13 vServico...

CVE-2021-4297: Incorrect Default Permissions

A vulnerability has been found in trampgeek jobe up to 1.6.4 and classified as problematic. This vulnerability affects the function runspost of the file application/controllers/Restapi.php. The manipulation of the argument sourcefilename leads to an unknown weakness. Upgrading to version 1.6.5 is...

CVE-2022-34132

Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php...

CVE-2022-34134

Jorani v1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /application/controllers/Users.php...

CVE-2022-34133

Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

CVE-2022-34134

Jorani v1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /application/controllers/Users.php...

CVE-2022-34132: Improper Neutralization of Special Elements used in an SQL Command

Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php...

CVE-2022-34133: Improper Neutralization of Input During Web Page Generation

Jorani v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Comment parameter at application/controllers/Leaves.php...

CVE-2022-34134: Cross-Site Request Forgery (CSRF)

Jorani v1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /application/controllers/Users.php...

CVE-2021-40612: Undefined Security Weakness

An issue was discovered in Opmantek Open-AudIT after 3.5.0. Without authentication, a vulnerability in codeigniter/application/controllers/util.php allows an attacker perform command execution without echoes...

Cross-site scripting in application/controllers/dropbox.php in JustWriting

Cross-site scripting XSS vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter...

CVE-2021-41467: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter...

CVE-2019-9960: Improper Limitation of a Pathname to a Restricted Directory

The downloadZip function in application/controllers/admin/export.php in LimeSurvey through 3.16.1+190225 allows a relative path...

CVE-2018-8057

A SQL Injection vulnerability exists in Western Bridge Cobub Razor 0.8.0 via the channelname or platform parameter in a /index.php?/manage/channel/addchannel request, related to /application/controllers/manage/channel.php...

CVE-2014-5016

Multiple cross-site scripting XSS vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject arbitrary web script or HTML via 1 the pid attribute to the getAttributejson function to application/controllers/admin/participantsaction.php in CPDB, 2 the sa parameter to...

PT-2014-6249

Name of the Vulnerable Software and Affected Versions LimeSurvey versions 2.05 and later Description The issue allows remote attackers to execute arbitrary SQL commands via the sidx parameter in a JSON request to "admin/participants/sa/getParticipants json", related to a search parameter. This is...

PT-2014-6248

Name of the Vulnerable Software and Affected Versions LimeSurvey versions 2.05 and later Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved through the pid attribute to the getAttribute json function in...

CVE-2014-5016: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject arbitrary web script or HTML via 1 the pid attribute to the getAttributejson function to application/controllers/admin/participantsaction.php in CPDB, 2 the sa parameter to...