S-CMS e-commerce system aj***.php page L_f*** parameter has SQL injection vulnerability

S-CMS e-commerce system is an e-commerce software. S-CMS e-commerce system aj.php page Lf parameter exists SQL injection vulnerability, an attacker can use the vulnerability to obtain database sensitive information...

DedeCMS Cross-Site Scripting Vulnerability (CNVD-2019-01728)

DedeCMS is a PHP-based web content management system CMS. A cross-site scripting vulnerability exists in the /member/uploadsselect.php file in DedeCMS version 5.7 SP2, which can be exploited by a remote attacker with the help of the 'f' or 'keyword' parameter to A remote attacker can use the 'f' ...

CVE-2018-17832

XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter...

CVE-2018-17832

WUZHICMS 2.0 is affected by a Cross-Site Scripting (XSS) vulnerability in index.php, exploitable via the v and f GET parameters. The issue is described as XSS in the WUZHICMS 2.0 web application, with PoC references showing injected content via index.php?v= and index.php?f=. No explicit root-caus...

CVE-2018-17832: Improper Neutralization of Input During Web Page Generation

XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter...

CVE-2018-13123

onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to read arbitrary files via the i and f parameters, as demonstrated by ?i=etc/&f=passwd&p=rawview for the /etc/passwd file...

CVE-2018-13123: Exposure of Sensitive Information to an Unauthorized Actor

onefilecms.php in OneFileCMS through 2017-10-08 might allow attackers to read arbitrary files via the i and f parameters, as demonstrated by ?i=etc/&f=passwd&p=rawview for the /etc/passwd file...

CVE-2018-12054: Improper Limitation of a Pathname to a Restricted Directory

Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal...

CVE-2018-12042: Improper Limitation of a Pathname to a Restricted Directory

Roxy Fileman through v1.4.5 has Directory traversal via the php/download.php f parameter...

CVE-2017-15381: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection exists in E-Sic 1.0 via the f parameter to esiclivre/restrito/inc/buscacep.php aka the zip code search script...

MediaWiki cross-site scripting vulnerability (CNVD-2015-05871)

MediaWiki is a free and free web-based Wiki engine developed and maintained by the Wikimedia Foundation and MediaWiki volunteers, which can be used to deploy in-house knowledge management and content management systems. A cross-site scripting vulnerability exists in MediaWiki's thumb.php script. ...

DEBIAN-CVE-2015-6730

Cross-site scripting XSS vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images."...

UBUNTU-CVE-2015-6730

Cross-site scripting XSS vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images."...

CVE-2015-6730

Cross-site scripting XSS vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images."...

CVE-2015-6730

Cross-site scripting XSS vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images."...

CVE-2015-6730: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not properly handled in an error page, related to "ForeignAPI images."...

PT-2015-7320

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.23.10 MediaWiki versions 1.24.x prior to 1.24.3 MediaWiki versions 1.25.x prior to 1.25.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via the f parameter, which is not...

CVE-2013-7174: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in cgi-bin/jc.cgi in QNAP QTS before 4.1.0 allows remote attackers to read arbitrary files via a full pathname in the f parameter...

CVE-2012-5314: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ViewGit 0.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the f parameter...

CVE-2012-0896: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter...