302 matches found
CVE-2022-31382
Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter in search-dirctory.php...
VulnCheck KEV: CVE-2018-16763
FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution...
GHSA-R68M-WQ3X-2HQW OpenTSDB Cross-site Scripting vulnerability
An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter json to the /q URI...
CVE-2022-30525 (FIXED): Zyxel Firewall Unauthenticated Remote Command Injection
Rapid7 discovered and reported a vulnerability that affects Zyxel firewalls supporting Zero Touch Provisioning ZTP, which includes the ATP series, VPN series, and the USG FLEX series including USG20-VPN and USG20W-VPN. The vulnerability, identified as CVE-2022-30525, allows an unauthenticated and...
Spotweb Cross-Site Scripting Vulnerability (CNVD-2022-34641)
Spotweb is a Php-based Soptnet client that follows the Spotnet protocol from the Spotweb team.Spotweb is vulnerable to cross-site scripting, which can be exploited by remote attackers to inject arbitrary Web scripts or HTML via the dataperformredirect parameter...
UBUNTU-CVE-2021-43725
There is a Cross Site Scripting XSS vulnerability in SpotPagelogin.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the dataperformredirect parameter...
WordPress WP Email Users plugin SQL注入漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress WP Email Users plugin version 1.7.6 and previous versions have a SQL injection vulnerability, which originates from WP Email...
PT-2025-45369
Name of the Vulnerable Software and Affected Versions Advantech iView versions prior to 5.7.04 build 6425 Description The software contains a flaw in the SNMP management tool that permits remote attackers to circumvent authentication procedures and exploit a SQL injection issue. The SQL injection...
CVE-2021-24955: Improper Neutralization of Input During Web Page Generation
The User Registration, Login Form, User Profile & Membership WordPress plugin before 3.2.3 does not escape the data parameter of the ppgetformsbybuildertype AJAX action before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-38344: Improper Neutralization of Input During Web Page Generation
The Brizy Page Builder plugin = 2.3.11 for WordPress was vulnerable to stored XSS by lower-privileged users such as a subscribers. It was possible to add malicious JavaScript to a page by modifying the request sent to update the page via the brizyupdateitem AJAX action and adding JavaScript to th...
CVE-2021-24424
The WP Reset – Most Advanced WordPress Reset Tool WordPress plugin before 1.90 did not sanitise or escape its extradata parameter when creating a snapshot via the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue...
CVE-2020-24148: Server-Side Request Forgery (SSRF)
Server-side request forgery SSRF in the Import XML and RSS Feeds import-xml-feed plugin 2.0.1 for WordPress via the data parameter in a moovereadxml action...
WordPress 跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Jannah WordPress theme versions prior to...
CVE-2020-23522
Pixelimity 1.0 has cross-site request forgery via the admin/setting.php data Password parameter...
CVE-2020-35748
Cross-site scripting XSS vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the fvwpfvvideoplayersrc JSON field in the data parameter...
WordPress FV Flowplayer Video Player 跨站脚本漏洞
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.FV Flowplayer Video Player is a video player plugin used in it. relevant is a relevant content display plugin used in it. A cross-site...
Online Marriage Registration System SQL Injection Vulnerability
Online Marriage Registration System is a website builder that supports online marriage registration. A SQL injection vulnerability exists in Online Marriage Registration System version 1.0, which stems from a lack of validation of the searchdata parameter of the search.php request against an...
Phpgurukul Online Marriage Registration System SQL注入漏洞
Online Marriage Registration System is a website builder that supports online marriage registration. A SQL injection vulnerability exists in Online Marriage Registration System version 1.0, which stems from a lack of validation of the searchdata parameter of the search.php request against an...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection a malicious user could inject commands through the data variable: Affected Area require'../server/getJsonByCurl'mock2easy, function error, stdout if error return res.json500, error; res.jsonJSON.parsestdout; , '',...