OpenCats 跨站脚本漏洞

OpenCats is an open source recruitment process management system. A security vulnerability exists in OpenCats v0.9.6, which stems from a security issue with the email parameter in the Check Email feature. No details of the vulnerability are provided at this time...

PT-2022-7072 · Opencats · Opencats

Name of the Vulnerable Software and Affected Versions: OpenCATS version 0.9.6 Description: The issue is related to a reflected cross-site scripting XSS vulnerability in the Check Email function of OpenCATS. This vulnerability can be exploited via the email parameter, potentially allowing a remote...

CVE-2022-41403

OpenCart 3.x Newsletter Custom Popup was discovered to contain a SQL injection vulnerability via the email parameter at index.php?route=extension/module/sonewlettercustompopup/newsletter...

OpenCart SQL注入漏洞

OpenCart is an open source e-commerce system by OpenCart team. The system provides modules for product reviews, product ratings, and product additions. A security vulnerability exists in OpenCart version 3.x, which originates from the email parameter of its Newsletter Custom Popup module URL:...

PT-2022-25844 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: OpenCart versions 3.x Description: A SQL injection issue was found in the Newsletter Custom Popup module of OpenCart. The vulnerability can be exploited via the email parameter at the "index.php?route=extension/module/so newletter custom...

No limit in email length may result in a possible DOS attack

Description As per RFC the maximum length allowed for an email address is 255 characters. However, rdiffweb don't validate email length, so you can add email addresses that exceed 255 characters. Through this, if you sign up for an email with a length of 1 million or more and log in, withdraw, or...

CVE-2022-36581

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via the useremail parameter at /admin/login.php...

CVE-2022-36581

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via the useremail parameter at /admin/login.php...

Online Diagnostic Lab Management System 跨站脚本漏洞

Online Diagnostic Lab Management System is an online diagnostic lab management system. A cross-site scripting vulnerability exists in Online Diagnostic Lab Management System version 1.0, which originates from an XSS via the firstname, address, middlename, lastname , gender, email, contact...

PT-2022-19010 · Sourcecodester · Sourcecodester Gym Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Gym Management System affected versions not specified Description: A critical issue has been found in the SourceCodester Gym Management System, affecting the file login.php. The manipulation of the user email argument leads to...

Electronic Medical Records System SQL注入漏洞

Electronic Medical Records System is an electronic medical records system. Electronic Medical Records System suffers from a SQL injection vulnerability that stems from an unknown function of its POST request handler that operates on the parameter useremail to cause sql injection. The attack metho...

SourceCodester Garage Management System SQL注入漏洞

SourceCodester Garage Management System Cms-Website is a garage management system by mayurik personal developer. It helps you manage all your vehicles, cars and motorcycles. An SQL injection vulnerability exists in SourceCodester Garage Management System, which stems from the parameter...

Multi Language Hotel Management Software SQL注入漏洞

Multi Language Hotel Management Software is a multilingual hotel management software by Nikhil B Individual Developer. Multi Language Hotel Management Software suffers from a SQL injection vulnerability that originates in an affected unknown function, where manipulation of the parameter email...

CVE-2022-34989

Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recoveremail parameter at userpasswordrecover.php...

Glassdoor: [CRITICAL] Full account takeover without user interaction on sign with Apple flow

An account takeover was detected with our sign-up with Apple flow where an email parameter was manipulated in the request flow to our servers. This scenario can only be performed on a previously unlinked apple ID account with Glassdoor. Changing the email in the request flow allowed the researche...

CVE-2022-31127

NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.:...

GHSA-HQMP-VXJ7-5WPQ Cross-site Scripting in Jenkins Validating Email Parameter Plugin

Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type. Additionally, it disables the security hardening added in Jenkins 2.44 and LTS 2.32.2 as part of the SECURITY-353 / CVE-2017-2601 fix that protects the "Build With...

Cross-site Scripting in Jenkins Validating Email Parameter Plugin

Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type. Additionally, it disables the security hardening added in Jenkins 2.44 and LTS 2.32.2 as part of the SECURITY-353 / CVE-2017-2601 fix that protects the "Build With...

CVE-2022-34791

Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2022-34791

Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...