78 matches found
Projectworlds Railway Reservation System SQL Injection Vulnerability
Projectworlds Railway Reservation System is a railroad reservation system from Projectworlds India. A SQL injection vulnerability exists in Projectworlds Railway Reservation System v1.0, which stems from the "from" parameter of reservation.php not validating received characters and sending them t...
CVE-2023-6360
The 'My Calendar' WordPress Plugin, version 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route...
CVE-2023-6360: Improper Neutralization of Special Elements used in an SQL Command
The 'My Calendar' WordPress Plugin, version 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route...
PT-2023-7555 · WordPress · Wordpress Calendar Plugin
Name of the Vulnerable Software and Affected Versions: My Calendar WordPress Plugin version 3.4.22 Description: The issue is related to an unauthenticated SQL injection vulnerability. This vulnerability is present in the from and to parameters in the "/my-calendar/v1/events" rest route. It allows...
CVE-2023-29985
Sourcecodester Student Study Center Desk Management System v1.0 admin\reports\index.phpdatefrom has a SQL Injection vulnerability...
PT-2023-22504 · Unknown · Sourcecodester Student Study Center Desk Management System
Name of the Vulnerable Software and Affected Versions: Sourcecodester Student Study Center Desk Management System version 1.0 Description: The issue is related to a SQL Injection vulnerability. It affects the adminreportsindex.php endpoint, specifically the date from parameter. Recommendations: F...
CVE-2023-31703
Cross Site Scripting XSS in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter...
MicroWorld eScan Management Console 跨站脚本漏洞
MicroWorld eScan Management Console is a control panel from MicroWorld Japan. It helps system administrators remotely manage all eScan client computers on a network. A security vulnerability exists in MicroWorld eScan Management Console version 14.0.1400.2281, which originates from the presence o...
CVE-2023-31703: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter...
PT-2023-10349 · Unknown · Arno0X Twofactorauth
Name of the Vulnerable Software and Affected Versions: Arno0x TwoFactorAuth affected versions not specified Description: A problematic vulnerability has been found in Arno0x TwoFactorAuth, affecting an unknown part of the file login/login.php. The manipulation of the from argument leads to open...
Student Study Center Desk Management System SQL注入漏洞
Student Study Center Desk Management System is a student study center desk management system. A SQL injection vulnerability exists in SourceCodester Student Study Center Desk Management System version 1.0, which originates from a security issue in the admin/?page=reports&datefrom=2023-02-17& of t...
Expense Management System SQL注入漏洞
Expense Management System is an expense management system by Carlo Montero Personal Developer. SourceCodester Expense Management System suffers from a SQL injection vulnerability that originates in the report.php component where the POST parameter handler of the fetchreportcredit function operate...
VaderPoolV2 minting synths & fungibles can be frontrun
Handle cmichel Vulnerability details The VaderPoolV2 mintFungible and mintSynth functions perform an unsafe nativeAsset.safeTransferFromfrom, addressthis, nativeDeposit with a parameter-specified from address. Note that these functions are not called by the Router, they are directly called on the...
CVE-2021-38315: Improper Neutralization of Input During Web Page Generation
The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the /functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25...
CVE-2019-17599: Improper Neutralization of Input During Web Page Generation
The quiz-master-next aka Quiz And Survey Master plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter and/or the quizid parameter. The component is:...
CVE-2019-17515
The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter. The component is: inc/cleantalk-users.php and...
CVE-2019-12361
EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page...
CVE-2019-12361: Improper Neutralization of Input During Web Page Generation
EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page...
CVE-2018-5991: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or to parameter in a view=stats request, a different vulnerability than CVE-2015-2798...
