26 matches found
CVE-2026-86732
Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...
EUVD-2026-72868
Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...
CVE-2026-86732 Craft CMS before 5.10.12 Remote Code Execution via element-index
Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...
CVE-2026-86732 Craft CMS before 5.10.12 Remote Code Execution via element-index
Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...
CVE-2026-86732 Craft CMS before 5.10.12 Remote Code Execution via element-index
Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...
PT-2026-87129
Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...
PT-2026-77233
Name of the Vulnerable Software and Affected Versions reportico-web versions prior to 8.1.1 Description A reflected cross-site scripting XSS issue allows remote attackers to execute arbitrary JavaScript in a user's web browser. This occurs when a malicious payload is included in the reportico...
CVE-2026-70372 Koha - SQL Injection in reports/bor_issues_top.pl
Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha databa...
EUVD-2024-30443
Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently...
CVE-2024-32641: Improper Control of Generation of Code
Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently...
CVE-2025-12262 code-projects Online Event Judging System edit_criteria.php sql injection
A vulnerability was determined in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /editcriteria.php. Executing manipulation of the argument critid can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed an...
EUVD-2017-9136
Malware in sbrugna...
EUVD-2022-29147
Malicious code in bioql PyPI...
CVE-2022-24240
ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp...
CVE-2022-24240
ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp...
Sql injection
ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp...
CVE-2022-24240: Improper Neutralization of Special Elements used in an SQL Command
ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp...
PT-2022-16558
Name of the Vulnerable Software and Affected Versions ACEweb Online Portal version 3.5.065 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the criteria parameter in the showschedule.awp endpoint. Recommendations For ACEweb Online Portal...
Biometric Shift Employee Management System Cross-Site Scripting Vulnerability (CNVD-2018-01396)
Biometric Shift Employee Management System is an employee management system. A cross-site scripting vulnerability exists in Biometric Shift Employee Management System. The vulnerability can be exploited to conduct cross-site scripting attacks via the criteria parameter in the...