PT-2017-14548 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.1.4-15217 Synology DiskStation Manager DSM versions prior to 6.0.3-8754-6 Description: An improper access control issue in synodsmnotify allows local users to inject arbitrary web script or...

jurefs-fn-ltk-rv.de XSS vulnerability

Open Bug Bounty ID: OBB-456252 Description| Value ---|--- Affected Website:| jurefs-fn-ltk-rv.de Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Che...

CVE-2017-17651

Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/viewvisitcamp.php fn parameter...

Sql injection

Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/viewvisitcamp.php fn parameter...

CVE-2017-17651

Paid To Read Script 2.0.5 has SQL Injection via the admin/userview.php uid parameter, the admin/viewemcamp.php fnum parameter, or the admin/viewvisitcamp.php fn parameter...

Unfixed XSS vulnerability at www.fn-franchecomte.com

Security researcher Xylitol, has submitted on 06/10/2009 a cross-site-scripting XSS vulnerability affecting www.fn-franchecomte.com, which at the time of submission ranked 19257728 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 20/12/2011. It ...

CVE-2008-4622

The isLoggedIn function in fastnews-code.php in phpFastNews 1.0.0 allows remote attackers to bypass authentication and gain administrative access by setting the fn-loggedin cookie to 1...

Cross site scripting

Cross-site scripting XSS vulnerability in actions.php in Positive Software H-Sphere WebShell 4.3.10 allows remote attackers to inject arbitrary web script or HTML via 1 the fn parameter during a dload action, 2 the mask parameter during a search action, and 3 the tab parameter during a sysinfo...

Sql injection

SQL injection vulnerability in index.php in ExoPHPdesk allows remote attackers to execute arbitrary SQL commands via the user parameter in a profile fn action...

CVE-2007-5991

SQL injection vulnerability in index.php in ExoPHPdesk allows remote attackers to execute arbitrary SQL commands via the user parameter in a profile fn action...

CVE-2006-6139

CVE-2006-6139 is a directory traversal vulnerability in the downloadexcel.php component of Sisfo Kampus 2006 (Semarang 3). It allows remote attackers to read arbitrary files via the fn parameter. This description is supported by NVD/CVE records; exploitation status is not provided in the document...