CVE-2021-24924: Improper Neutralization of Input During Web Page Generation

The Email Log WordPress plugin before 2.4.8 does not escape the d parameter before outputting it back in an attribute in the Log page, leading to a Reflected Cross-Site Scripting issue...

PT-2021-16369

Name of the Vulnerable Software and Affected Versions: Email Log WordPress plugin versions prior to 2.4.8 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the d parameter is not properly escaped before being outputted back in an attribute on the Log...

CVE-2021-24908

The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting...

CVE-2021-24908

The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting...

CVE-2021-24908: Improper Neutralization of Input During Web Page Generation

The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting...

PT-2021-16363

Name of the Vulnerable Software and Affected Versions: Check & Log Email WordPress plugin versions prior to 1.0.4 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the d parameter is not properly escaped before being outputted back in an attribute...

CVE-2021-20115

A reflected cross-site scripting vulnerability exists in TCExam = 14.8.3. The paths provided in the f, d, and dir parameters in tcefilemanager.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link...

CVE-2021-20116: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability exists in TCExam = 14.8.4. The paths provided in the f, d, and dir parameters in tceselectmediafile.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious lin...

CVE-2021-20115: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability exists in TCExam = 14.8.3. The paths provided in the f, d, and dir parameters in tcefilemanager.php were not properly validated and could cause reflected XSS via the unsanitized output of the path supplied. An attacker could craft a malicious link...

PT-2019-15908

Name of the Vulnerable Software and Affected Versions nopCommerce version 4.2.0 Description The issue concerns a path traversal vulnerability via ../ in the d or f parameters to "Admin/RoxyFileman/ProcessRequest" due to a flaw in "Libraries/Nop.Services/Media/RoxyFileman/FileRoxyFilemanService.cs...

PT-2017-5957

Name of the Vulnerable Software and Affected Versions: Landesk Management Suite versions 9.6 and earlier Description: The issue allows remote attackers to conduct remote file inclusion attacks involving ASPX pages from third-party sites. This can be achieved via the d parameter to API endpoints...

CVE-2014-5362: Improper Input Validation

The admin interface in Landesk Management Suite 9.6 and earlier allows remote attackers to conduct remote file inclusion attacks involving ASPX pages from third-party sites via the d parameter to 1 ldms/smactionfrm.asp or 2 remote/frmcoremainfrm.aspx; or the 3 top parameter to...

PT-2014-7205

Name of the Vulnerable Software and Affected Versions PHPCompta/NOALYSS versions prior to 6.7.2 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the d parameter of the backup.php file. Recommendations For versions prior to 6.7.2, update to...

CVE-2014-6389: Improper Control of Generation of Code

backup.php in PHPCompta/NOALYSS before 6.7.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the d parameter...

CVE-2014-2219: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in whizzywig/wb.php in CMSimple Classic 3.54 and earlier, possibly as downloaded before February 26, 2014, allows remote attackers to inject arbitrary web script or HTML via the d parameter...

PT-2014-4563

Name of the Vulnerable Software and Affected Versions CMSimple Classic versions 3.54 and earlier Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the d parameter. This could potentially lead to unauthorized actions on the affected...

CVE-2013-3721

SQL injection vulnerability in awards.php in PsychoStats 3.2.2b allows remote attackers to execute arbitrary SQL commands via the d parameter...

CVE-2013-3721: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in awards.php in PsychoStats 3.2.2b allows remote attackers to execute arbitrary SQL commands via the d parameter...

PT-2013-4580

Name of the Vulnerable Software and Affected Versions PsychoStats version 3.2.2b Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the d parameter in the awards.php file. Recommendations For PsychoStats version 3.2.2b, consider restricting acces...

PT-2011-5188

Name of the Vulnerable Software and Affected Versions Pulse Pro CMS version 1.7.2 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities can be exploit...