48 matches found
CVE-2021-27581
The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter...
EUVD-2021-14329
Malware in sbrugna...
EUVD-2011-5040
Malware in sbrugna...
EUVD-2012-3783
Malware in sbrugna...
EUVD-2012-1253
Malware in sbrugna...
EUVD-2006-5204
Malware in sbrugna...
EUVD-2022-6467
Malicious code in bioql PyPI...
EUVD-2022-41450
Malicious code in bioql PyPI...
EUVD-2025-25179
Malicious code in bioql PyPI...
📄 ERPNext 15.67.0 / Frappe 15.72.4 Cross Site Scripting
ERPNext version 15.67.0 and Frappe version 15.72.4 suffer from a persistent cross site scripting vulnerability. CVE-2025-56379 — Stored Cross-Site Scripting XSS in ERPNext 15.67.0 / Frappe 15.72.4 📌 Summary A stored Cross‑Site Scripting XSS vulnerability exists in the Blog module of ERPNext...
SQL Injection
moonshine/moonshine is vulnerable to SQL injection. The vulnerability is due to improper handling of the Data parameter in the Blog module, which allows an attacker to inject malicious SQL queries...
GHSA-9G9J-3W64-3CJH MoonShine SQL Injection Vulnerability
MoonShine v3.12.5 was discovered to contain a SQL injection vulnerability via the Data parameter under the Blog module...
MoonShine SQL Injection Vulnerability
MoonShine v3.12.5 was discovered to contain a SQL injection vulnerability via the Data parameter under the Blog module...
PT-2025-33264 · Moonshine · Moonshine
Name of the Vulnerable Software and Affected Versions: MoonShine version 3.12.5 Description: MoonShine version 3.12.5 contains a SQL injection issue within the Blog module, specifically through the Data parameter. Recommendations: As a temporary workaround, consider restricting access to the Blog...
CVE-2023-43979
ETS Soft ybcblog before v4.4.0 was discovered to contain a SQL injection vulnerability via the component YbcblogBlogModuleFrontController::getPosts...
CVE-2022-38902
A Cross-site scripting XSS vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic...
PT-2022-24615 · Liferay · Liferay Digital Experience Platform
Name of the Vulnerable Software and Affected Versions: Liferay Digital Experience Platform version 7.3.10 SP3 Description: A Cross-site scripting XSS issue in the Blog module's add new topic functionality allows remote attackers to inject arbitrary JS script or HTML into the name field of newly...
Jfinal Cross-site Scripting vulnerability
Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module...
CVE-2022-36527
Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module...
CVE-2022-36527
Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module...