CVE-2021-38168

Roxy-WI through 5.2.2.0 allows authenticated SQL injection via selectservers...

CVE-2021-24371 RSVPMaker < 8.7.3 - Authenticated (admin+) SSRF

The Import feature of the RSVPMaker WordPress plugin before 8.7.3 /wp-admin/tools.php?page=rsvpmakerexportscreen takes an URL input and calls curl on it, without first validating it to ensure it's a remote one. As a result, a high privilege user could use that feature to scan the internal network...

Blackcat Cms 跨站脚本漏洞

Blackcat Cms is a Php-based content management system from the Blackcat team. A cross-site scripting vulnerability exists in BlackCat CMS version 1.3.6, which can be exploited by an authenticated attacker to execute arbitrary web script or HTML via a crafted payload with the "Add Page" parameter...

Vulnerabilities fixed in Cisco Finesse

Vulnerabilities have been fixed in Cisco Finesse. The vulnerability with reference CVE-2021-1254 allows an authenticated malicious person remotely capable of executing a Cross-Site scripting attack and thereby executing arbitrary code under the privileges of the user. The vulnerability with...

CVE-2020-27246

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoComment parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...

CVE-2020-27245

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoBuyer parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...

CVE-2020-27244

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoCode parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabili...

CVE-2020-27243

OpenClinic GA 5.173.3 contains authenticated SQL injection flaws in the listImmoLabels.jsp page. The vulnerabilities arise from building SQL with user-supplied parameters (e.g., immoService, immoLocation, immoCode, immoBuyer, immoComment) and then executing via a prepared statement, enabling inje...

CVE-2020-27242

An exploitable SQL injection vulnerability exists in ‘listImmoLabels.jsp’ page of OpenClinic GA 5.173.3 application. The immoLocation parameter in the ‘listImmoLabels.jsp’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...

CVE-2020-27226

An exploitable SQL injection vulnerability exists in ‘quickFile.jsp’ page of OpenClinic GA 5.173.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27229

A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. The findPersonID parameter in ‘‘patientslist.do’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...

Sql injection

A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. The findPersonID parameter in ‘‘patientslist.do’ page is vulnerable to authenticated SQL injection. An attacker can make an authenticated HTTP request to trigger this...

CVE-2020-27232

An exploitable SQL injection vulnerability exists in ‘manageServiceStocks.jsp’ page of OpenClinic GA 5.173.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2020-27231

CVE-2020-27231 affects OpenClinic GA 5.173.3. The connected TALOS advisory documents multiple authenticated SQL injection vulnerabilities in the patientslist.do page, notably via the findDistrict, findPersonID, and findSector parameters, leading to possible data exposure or manipulation. The CVE ...

CVE-2020-27229

CVE-2020-27229 concerns OpenClinic GA 5.173.3, where multiple authenticated SQL injection vulnerabilities exist in the web page patientslist.do . The root cause is improper handling of user input in the findPersonID, findSector, and findDistrict parameters, leading to crafted HTTP requests that c...

Schlix CMS 2.2.6-6 Cross Site Scripting

Exploit Title: Schlix CMS 2.2.6-6 - 'title' Persistent Cross-Site Scripting Authenticated Date: 2021-05-05 Exploit Author: Emircan Baş Vendor Homepage: https://www.schlix.com/ Software Link: https://www.schlix.com/downloads/schlix-cms/schlix-cms-v2.2.6-6.zip Version: 2.2.6-6 Tested on: Windows &...

Cisco Firepower Management Center 跨站脚本漏洞

Cisco Firepower Management Center FMC is the next generation firewall management center software from Cisco. Cisco Firepower Management Center: 6.4.0.11 A cross-site scripting vulnerability exists that stems from a lack of sufficient cleanup of user-supplied data in the web-based management...

CVE-2020-27234

An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

OpenClinic GA web portal multiple SQL injection vulnerabilities in 'patientslist.do' page

Summary A number of exploitable SQL injection vulnerabilities exists in ‘patientslist.do’ page of OpenClinic GA 5.173.3 application. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability. Tested Versions...

CVE-2021-24196

The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘tokenerror’ parameter can be controlled by users and it is directly echoed without being sanitized...