257 matches found
Cross site scripting
Diafan CMS v6.0 was discovered to contain a reflected cross-site scripting via the catid parameter at /shop/?module=shop&action=search...
CVE-2023-37164
CVE-2023-37164 describes a reflected cross-site scripting vulnerability in Diafan CMS v6.0. The issue arises from insufficient filtering/escaping of user-supplied data in the cat_id parameter of the endpoint "/shop/?module=shop&action=search". This permits an attacker to inject arbitrary web scri...
CVE-2023-3528
A vulnerability was found in ThinuTech ThinuCMS 1.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /category.php. The manipulation of the argument catid leads to sql injection. The attack may be launched remotely. The identifier of this...
PuneethReddyHc Online Shopping System Advanced SQL注入漏洞
PuneethReddyHc Online Shopping System Advanced is an open source online shopping system from the individual developers at Puneeth Reddy HC in India. PuneethReddyHc Online Shopping System Advanced suffers from a SQL injection vulnerability that originates in the /homeaction.php catid parameter...
Exploit for SQL Injection in Online-Shopping-System-Advanced_Project Online-Shopping-System-Advanced
CVE-2021-41649 CVE-2021-41649 SQL Injection in online-shoppin...
CVE-2021-24342
The JNews WordPress theme before 8.0.6 did not sanitise the catid parameter in the POST request /?ajax-request=jnews with action=jnewsbuildmegacategory, leading to a Reflected Cross-Site Scripting XSS issue...
Victor CMS SQL Injection Vulnerability (CNVD-2020-59730)
Victor CMS is a simple content management system. A SQL injection vulnerability exists in the catid parameter in category.php in Victor CMS 1.0. An attacker can exploit this vulnerability to obtain data information in the database...
CVE-2020-23945
A SQL injection vulnerability exists in Victor CMS V1.0 in the catid parameter of the category.php file. This parameter can be used by sqlmap to obtain data information in the database...
CVE-2020-23945
A SQL injection vulnerability exists in Victor CMS V1.0 in the catid parameter of the category.php file. This parameter can be used by sqlmap to obtain data information in the database...
Sql injection
A SQL injection vulnerability exists in Victor CMS V1.0 in the catid parameter of the category.php file. This parameter can be used by sqlmap to obtain data information in the database...
CVE-2020-12708
Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the catid parameter to downloads/downloads.php or article.php. NOTE: this might overlap CVE-2012-6043...
Cross site scripting
Multiple cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the catid parameter to downloads/downloads.php or article.php. NOTE: this might overlap CVE-2012-6043...
CVE-2020-12708
PHP-Fusion 9.03.50 is affected by multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary script or HTML via the cat_id parameter to downloads/downloads.php or article.php. The issue is a result of insufficient input validation in these endpoints and is...
CVE-2018-8879
Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to execute arbitrary code by providing a long string to the blocking.asp page via a GET or POST request. Vulnerable parameters ar...
CVE-2018-8879
Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to execute arbitrary code by providing a long string to the blocking.asp page via a GET or POST request. Vulnerable parameters ar...
CVE-2015-9462
The awesome-filterable-portfolio plugin before 1.9 for WordPress has afpgetnewcategorypage SQL injection via the catid parameter...
CVE-2015-9462
The awesome-filterable-portfolio plugin before 1.9 for WordPress has afpgetnewcategorypage SQL injection via the catid parameter...
CMSsite 1.0 - 'cat_id' SQL Injection
Exploit Title: CMSsite 1.0 - SQL injection Exploit Author : Majid kalantari [email protected] Date: 2019-01-27 Vendor Homepage : https://github.com/VictorAlagwu/CMSsite Software link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip Version: 1.0 Tested on: Windows 10 CVE: N/A...
Website Auction Marketplace SQL Injection Vulnerability
Website Auction Marketplace is a software for creating e-commerce websites. A SQL injection vulnerability exists in Website Auction Marketplace version 2.0.5. The vulnerability can be exploited by remote attackers to inject SQL commands by sending the 'catid' parameter to the search.php file...