CVE-2025-15392 Kohana KodiCMS Search API Endpoint page.php like sql injection

A weakness has been identified in Kohana KodiCMS up to 13.82.135. This affects the function like of the file cms/modules/pages/classes/kodicms/model/page.php of the component Search API Endpoint. Executing manipulation of the argument keyword can lead to sql injection. It is possible to launch th...

CVE-2020-15538

XSS can occur in We-com Municipality portal CMS 2.1.x via the cerca/ search bar...

Sql injection

An issue was discovered in PbootCMS. There is a SQL injection via the api.php/Cms/search order parameter...

PT-2020-8558

Name of the Vulnerable Software and Affected Versions: PbootCMS affected versions not specified Description: An issue was discovered in PbootCMS, where there is a SQL injection via the "api.php/Cms/search" endpoint, specifically through the order parameter. Recommendations: At the moment, there i...

CVE-2018-16357: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in PbootCMS. There is a SQL injection via the api.php/Cms/search order parameter...

Design/Logic Flaw

dsmall v20180320 allows XSS via the public/index.php/home/predeposit/index.html pdrsn parameter aka the CMS search box...

CVE-2018-9015

dsmall v20180320 allows XSS via the public/index.php/home/predeposit/index.html pdrsn parameter aka the CMS search box...

CVE-2018-9015: Improper Neutralization of Input During Web Page Generation

dsmall v20180320 allows XSS via the public/index.php/home/predeposit/index.html pdrsn parameter aka the CMS search box...

PT-2018-18781

Name of the Vulnerable Software and Affected Versions dsmall version v20180320 Description The issue allows for XSS via the pdr sn parameter in the "public/index.php/home/predeposit/index.html" API endpoint, which is also referred to as the CMS search box. Recommendations For version v20180320,...

PT-2011-5044

Name of the Vulnerable Software and Affected Versions Hotaru CMS Search plugin version 1.3 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the SITE NAME parameter to "admin index.php", or the return and search parameters to "index.php...