1204 matches found
NamelessMC SQL注入漏洞
NamelessMC is a free, easy to use and powerful website software from the NamelessMC team. Suitable for your Minecraft server, it contains tons of features. A SQL injection vulnerability exists in NamelessMC versions prior to 2.1.4, which stems from the square bracketed GET parameter syntax could...
CVE-2025-3612
CVE-2025-3612 affects Demtec Graphytics 5.0.7. The issue resides in an unknown part of the file /visualization within the HTTP GET Parameter Handler component, where input manipulation enables cross-site scripting. Exploitation is possible remotely and publicized, with the vendor not responding t...
Demtec Graphytics 代码注入漏洞
Demtec Graphytics is an application from Demtec Corporation. A code injection vulnerability exists in Demtec Graphytics version 5.0.7 that stems from improper handling of HTTP GET parameters in the /visualization file, which could lead to a cross-site scripting attack...
PT-2025-16285 · Demtec · Demtec Graphytics
Name of the Vulnerable Software and Affected Versions: Demtec Graphytics version 5.0.7 Description: A vulnerability was found in Demtec Graphytics, affecting an unknown part of the file/visualization of the component HTTP GET Parameter Handler. The manipulation leads to cross-site scripting. It i...
CVE-2025-29033
An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET parameter...
CVE-2025-29033
An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET parameter...
PT-2025-35787
Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30 Description The application does not adequately validate user-supplied data from the GET parameter in scripts located at '/plugin/vchamilo/views/syncparams.php' and '/plugin/vchamilo/ajax/service.php'. This...
CVE-2025-29033
The CVE-2025-29033 issue affects BambooHR Build 25.0210.170831-83b08dd, where a remote attacker can escalate privileges through the GET parameter r of /saml/index.php. Descriptions across multiple feeds confirm the vulnerability path but do not supply an official patched version or vendor-issued ...
CVE-2025-2353
A vulnerability, which was classified as critical, was found in VAM Virtual Airlines Manager up to 2.6.2. Affected is an unknown function of the file /vam/index.php of the component HTTP GET Parameter Handler. The manipulation of the argument ID/registryid/planeicao leads to sql injection. It is...
CVE-2025-2353 VAM Virtual Airlines Manager HTTP GET Parameter index.php sql injection
A vulnerability, which was classified as critical, was found in VAM Virtual Airlines Manager up to 2.6.2. Affected is an unknown function of the file /vam/index.php of the component HTTP GET Parameter Handler. The manipulation of the argument ID/registryid/planeicao leads to sql injection. It is...
CVE-2025-2353
CVE-2025-2353 affects VAM Virtual Airlines Manager (up to 2.6.2). The root cause is SQL injection in an HTTP GET parameter handler in the /vam/index.php file, via the arguments ID/registry_id/plane_icao. This permits remote exploitation and can lead to unauthorized database access or manipulation...
CVE-2025-2353 VAM Virtual Airlines Manager HTTP GET Parameter index.php sql injection
A vulnerability, which was classified as critical, was found in VAM Virtual Airlines Manager up to 2.6.2. Affected is an unknown function of the file /vam/index.php of the component HTTP GET Parameter Handler. The manipulation of the argument ID/registryid/planeicao leads to sql injection. It is...
CVE-2025-2126
A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical. This issue affects some unknown processing of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties of the component GET Parameter Handler. The manipulation of the...
CVE-2025-2126 JoomlaUX JUX Real Estate GET Parameter realties sql injection
A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical. This issue affects some unknown processing of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties of the component GET Parameter Handler. The manipulation of the...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the $GET"id" parameter because of improper user input sanitization. An attacker can execute arbitrary code or access sensitive user information by injecting malicious scripts into this parameter. Details...
CVE-2024-45059
i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A SQL Injection vulnerability was found prior to the 2.9 branch in the ieducar/intranet/funcionariovinculodet.php file, which creates the query by...
Selesta Visual Access Manager SQL Injection Vulnerability (CNVD-2025-22657)
Selesta Visual Access Manager is a visual access manager from Selesta. A SQL injection vulnerability exists in Selesta Visual Access Manager. The vulnerability stems from the application's lack of validation of externally entered SQL statements, which can be exploited by an attacker to perform SQ...
CVE-2023-42236
An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /common/ajaxfunction.php...
PT-2025-1462 · Selesta · Selesta Visual Access Manager
Name of the Vulnerable Software and Affected Versions: Selesta Visual Access Manager VAM versions prior to 4.42.2 Description: An issue was discovered in Selesta Visual Access Manager VAM where an authenticated attacker can perform SQL Injection in a GET parameter of "/common/ajaxfunction.php"...