1513 matches found
CVE-2021-24679
The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-24679: Improper Neutralization of Input During Web Page Generation
The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-41294
ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GET parameter, unauthenticated attackers can remotely delete arbitrary files on the affected device and cause denial of service scenario...
Path traversal
ECOA BAS controller suffers from a path traversal content disclosure vulnerability. Using the GET parameter in File Manager, unauthenticated attackers can remotely disclose directory content on the affected device...
CVE-2021-41294 ECOA BAS controller - Path Traversal-4
ECOA BAS controller suffers from a path traversal vulnerability, causing arbitrary files deletion. Using the specific GET parameter, unauthenticated attackers can remotely delete arbitrary files on the affected device and cause denial of service scenario...
Ecoa Bas controller 路径遍历漏洞
ECOA BAS controller is a smart lighting control solution. A directory traversal vulnerability exists in the ECOA BAS controller GET parameter handling, which can be exploited by attackers to delete arbitrary files on the affected device and cause a denial of service scenario...
CVE-2020-20692
GilaCMS v1.11.4 was discovered to contain a SQL injection vulnerability via the $GET parameter in /src/core/controllers/cm.php...
Cross-site Scripting (XSS) - Reflected in yourls/yourls
✍️ Description Cross-site Scripting XSS refers to client-side code injection attack wherein an attacker can execute malicious scripts into a legitimate website or web application. XSS occurs when a web application makes use of unvalidated or unencoded user input within the output it generates. The...
Cross-site Scripting (XSS) - Reflected in universaloj/uoj-system
✍️ Description Cross-site Scripting XSS refers to client-side code injection attack wherein an attacker can execute malicious scripts into a legitimate website or web application. XSS occurs when a web application makes use of unvalidated or unencoded user input within the output it generates. The...
Cross-site Scripting (XSS) - Reflected in podcastgenerator/podcastgenerator
✍️ Description Cross-site Scripting XSS refers to client-side code injection attack wherein an attacker can execute malicious scripts into a legitimate website or web application. XSS occurs when a web application makes use of unvalidated or unencoded user input within the output it generates. The...
CVE-2021-24392
An id GET parameter of the WordPress Membership SwiftCloud.io WordPress plugin through 1.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...
CVE-2021-24395
The CVE-2021-24395 entry describes an SQL injection in the WordPress plugin “Embed Youtube Video” (<= 1.0) caused by the editid GET parameter being unsanitized, escaped, or validated before SQL statement insertion. Affected software: WordPress plugin Embed Youtube Video, version
CVE-2021-24391: Improper Neutralization of Special Elements used in an SQL Command
An editid GET parameter of the Cashtomer WordPress plugin through 1.0.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...
CVE-2021-24392: Improper Neutralization of Special Elements used in an SQL Command
An id GET parameter of the WordPress Membership SwiftCloud.io WordPress plugin through 1.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...
CVE-2021-24394: Improper Neutralization of Special Elements used in an SQL Command
An id GET parameter of the Easy Testimonial Manager WordPress plugin through 1.2.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...
CVE-2021-24303: Improper Neutralization of Special Elements used in an SQL Command
The JiangQie Official Website Mini Program WordPress plugin before 1.1.1 does not escape or validate the id GET parameter before using it in SQL statements, leading to SQL injection issues...
CVE-2021-24395: Improper Neutralization of Special Elements used in an SQL Command
The editid GET parameter of the Embed Youtube Video WordPress plugin through 1.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...
CVE-2021-24390: Improper Neutralization of Special Elements used in an SQL Command
A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection...
WMS SQL Injection Vulnerability
WMS is a warehouse management software. v1.0 version of WMS has a SQL injection vulnerability, the vulnerability is derived from the GET parameter "id" is passed without filtering, an attacker can use the vulnerability to obtain sensitive database information...