CVE-2026-86732

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

CVE-2026-86732 Craft CMS before 5.10.12 Remote Code Execution via element-index

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

EUVD-2026-72868

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

CVE-2026-86732 Craft CMS before 5.10.12 Remote Code Execution via element-index

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

CVE-2026-86732 Craft CMS before 5.10.12 Remote Code Execution via element-index

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

PT-2026-87129

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

PT-2026-77233

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reportico criteria parameter in conjunction with the execute mode=CRITERIA parameter of run.php...

CVE-2026-70372 Koha - SQL Injection in reports/bor_issues_top.pl

Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha databa...

EUVD-2024-30443

Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently...

CVE-2024-32641: Improper Control of Generation of Code

Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently...

CVE-2025-12262 code-projects Online Event Judging System edit_criteria.php sql injection

A vulnerability was determined in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /editcriteria.php. Executing manipulation of the argument critid can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed an...

EUVD-2017-9136

Malware in sbrugna...

EUVD-2022-29147

Malicious code in bioql PyPI...

CVE-2022-24240

ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp...

CVE-2022-24240

ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp...

Sql injection

ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp...

Biometric Shift Employee Management System Cross-Site Scripting Vulnerability (CNVD-2018-01396)

Biometric Shift Employee Management System is an employee management system. A cross-site scripting vulnerability exists in Biometric Shift Employee Management System. The vulnerability can be exploited to conduct cross-site scripting attacks via the criteria parameter in the...

CVE-2017-17994

Biometric Shift Employee Management System has XSS via the criteria parameter in an index.php?user=competencycriteria request...

Unfixed XSS vulnerability at www.searchinsa.com

Security researcher PhYtOn, has submitted on 25/04/2008 a cross-site-scripting XSS vulnerability affecting www.searchinsa.com, which at the time of submission ranked 410360 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/06/2008. It is...

CVE-2005-4395

Cross-site scripting XSS vulnerability in FarCry 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the criteria parameter...