113 matches found
CVE-2024-40137
Dolibarr ERP CRM versions prior to 19.0.2-php8.2 are vulnerable to remote code execution (RCE) via the Computed field parameter located under the Users Module Setup function. This vulnerability is characterized by the improper neutralization of special elements in output used by a downstream comp...
CVE-2024-40137
Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution RCE vulnerability via the Computed field parameter under the Users Module Setup function...
CVE-2024-40137: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Dolibarr ERP CRM before 19.0.2-php8.2 was discovered to contain a remote code execution RCE vulnerability via the Computed field parameter under the Users Module Setup function...
CVE-2023-41154
A Stored Cross-Site Scripting XSS vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the value field parameter while creating a new environment variable...
CVE-2023-41154: Improper Neutralization of Input During Web Page Generation
A Stored Cross-Site Scripting XSS vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrary web script or HTML via the value field parameter while creating a new environment variable...
CVE-2023-41593
Multiple cross-site scripting XSS vulnerabilities in Dairy Farm Shop Management System Using PHP and MySQL v1.1 allow attackers to execute arbitrary web scripts and HTML via a crafted payload injected into the Category and Category Field parameters...
CVE-2023-41593
Multiple cross-site scripting XSS vulnerabilities in Dairy Farm Shop Management System Using PHP and MySQL v1.1 allow attackers to execute arbitrary web scripts and HTML via a crafted payload injected into the Category and Category Field parameters...
PT-2023-23003
Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 10.5.21 Description The issue is related to a SQL injection vulnerability in the admin search find API. This vulnerability allows an attacker to interfere with the queries that the application makes to its database,...
CVE-2022-32366
Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/fields/viewfield.php?id=...
CVE-2022-25613
Authenticated Persistent Cross-Site Scripting XSS vulnerability in FV Flowplayer Video Player WordPress plugin versions = 7.5.18.727 via wpflowplayerfieldsplash parameter...
Chamilo LMS SQL注入漏洞
Chamilo is a learning management system focused on ease of use and accessibility. A SQL injection vulnerability exists in main/inc/ajax/model.ajax.php in Chamilo 1.11.14 and earlier versions. The vulnerability can be exploited by an attacker to conduct a SQL injection attack via the searchField,...
CVE-2017-11584
dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php...
Sql injection
dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php...
FineCms SQL Injection Vulnerability (CNVD-2017-18530)
FineCMS is a content management system CMS developed using MVC architecture and PDO database interface. A SQL injection vulnerability exists in FineCms version 5.0.9. A remote attacker can inject arbitrary SQL commands with the help of the 'field' parameter in an action=module, action=member,...
PT-2017-12119
Name of the Vulnerable Software and Affected Versions FineCms version 5.0.9 Description The issue concerns a SQL Injection flaw. It can be exploited via the field parameter in requests to "libraries/Template.php" with specific actions such as "module", "member", "form", or "related"...
CVE-2017-11584: Improper Neutralization of Special Elements used in an SQL Command
dayrui FineCms 5.0.9 has SQL Injection via the field parameter in an action=module, action=member, action=form, or action=related request to libraries/Template.php...
SQL Injection Vulnerability in Ocean CMS v_field Parameter
Ocean CMS is an open source website builder. An SQL injection vulnerability exists in the admindatarelate.php page in the official version of Ocean CMS 6.46 utf-8. The lack of filtering of the 'vfield' parameter allows attackers to exploit the vulnerability to obtain sensitive database informatio...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in dotProject before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via the 1 callback parameter in a colorselector action, 2 field parameter in a dateformat action, or 3 companyname parameter in an addedit action to index.php...
