Listeo < 1.6.11 - Multiple XSS & XFS vulnerabilities

The theme did not properly sanitise some parameters in its Search, Booking Confirmation and Personal Message pages, leading to Cross-Site Scripting issues - Unauthenticated Reflected XSS | Search query, vulnerable parameters: keywordsearch and locationsearch - Authenticated Persistent XSS & XFS |...

CVE-2021-27320

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter...

CVE-2021-27320

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter...

CVE-2021-27320

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter...

Sql injection

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter...

CVE-2021-27320

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter...

CVE-2021-27320: Improper Neutralization of Special Elements used in an SQL Command

Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter...

Doctor Appointment System 1.0 Blind SQL Injection Vulnerability

Exploit Title: Doctor Appointment System 1.0 Blind SQL injection in email parameter CVE: CVE-2021-27319 Exploit Author: Nakul Ratti Vendor Homepage: https://www.sourcecodester.com/php/14182/doctor-appointment-system.html Software Link:...

Mail.ru: Stored XSS на странице "Почты" [city-mobil.ru/taxiserv]

Stored XSS on city-mobil.ru/taxiserv mail page via firstname and lastname of driver...

Mail.ru: Stored XSS на странице "Изменить клиента", вкладка "История" [city-mobil.ru/taxiserv]

Stored XSS on city-mobil.ru/taxiserv driver page via firstname and lastname of driver...

PT-2020-14079 · Global Radar · Global Radar Bsa Radar

Name of the Vulnerable Software and Affected Versions: Global RADAR BSA Radar versions 1.6.7234.24750 and earlier Description: The issue concerns stored cross-site scripting XSS via the Update User Profile feature. Specifically, the Firstname and Lastname parameters are vulnerable. Recommendation...

CVE-2020-14943: Improper Neutralization of Input During Web Page Generation

The Firstname and Lastname parameters in Global RADAR BSA Radar 1.6.7234.24750 and earlier are vulnerable to stored cross-site scripting XSS via Update User Profile...

Mail.ru: HTTP-Response-Splitting leads to information disclosure (email, firstname, lastname) at https://tz.mail.ru

CRLF injection via GET paramaters in tz.mail.ru Clientside vulnerabilities in tz.mail.ru is not currently covered by Bug Bounty program...

osTicket 1.12 Cross Site Scripting

Exploit Title: osTicket-v1.12 Stored XSS Vendor Homepage: https://osticket.com/ Software Link: https://osticket.com/download/ Exploit Author: Aishwarya Iyer Contact: https://twitter.com/aish9524 Website: https://about.me/aishiyer Category: webapps CVE: CVE-2019-14750 1. Description An issue was...

CVE-2019-14750: Improper Neutralization of Input During Web Page Generation

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...

CVE-2019-14331: Improper Neutralization of Input During Web Page Generation

An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create User. A malicious attacker can modify the firstName and lastName to contain JavaScript code...

CVE-2019-14330: Improper Neutralization of Input During Web Page Generation

An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicious attacker can modify the firstName and lastName to contain JavaScript code...

PHP Scripts Mall Entrepreneur B2B Script Cross-Site Scripting Vulnerability

PHP Scripts Mall Entrepreneur B2B Script is a suite of B2B e-commerce platforms from PHP Scripts Mall India. A cross-site scripting vulnerability exists in PHP Scripts Mall Entrepreneur B2B Script version 3.0.6, which can be exploited by a remote attacker to inject arbitrary web script or HTML vi...

CVE-2018-20138: Improper Neutralization of Input During Web Page Generation

PHP Scripts Mall Entrepreneur B2B Script 3.0.6 allows Stored XSS via Account Settings fields such as FirstName and LastName, a similar issue to CVE-2018-14541...

PT-2018-15266

Name of the Vulnerable Software and Affected Versions PHP Scripts Mall Entrepreneur B2B Script version 3.0.6 Description The issue allows for Stored XSS attacks through certain fields in the Account Settings, such as FirstName and LastName. This is similar to a previously identified issue...