Sql injection

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exist in ladder/stats.php via the GET type parameter...

Sql injection

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET user parameter...

CVE-2017-18290

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET sortdirection parameter...

CVE-2017-18289

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exist in ladder/stats.php via the GET type parameter...

CVE-2017-18288

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET game parameter...

CVE-2017-18291

An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET user parameter...

CVE-2017-18288

The CVE-2017-18288 issue affects PvPGN Stats 2.4.6. A SQL injection exists in ladder/stats.php via the GET game parameter, due to insufficient input filtering in the code. This can allow an attacker to manipulate database queries, potentially accessing sensitive data. The connected Red Hat and CN...

CVE-2018-12090

There is unauthenticated reflected cross-site scripting XSS in LAMS before 3.1 that allows a remote attacker to introduce arbitrary JavaScript via manipulation of an unsanitized GET parameter during a forgotPasswordChange.jsp?key= password change...

CVE-2018-12090

There is unauthenticated reflected cross-site scripting XSS in LAMS before 3.1 that allows a remote attacker to introduce arbitrary JavaScript via manipulation of an unsanitized GET parameter during a forgotPasswordChange.jsp?key= password change...

Cross site scripting

There is unauthenticated reflected cross-site scripting XSS in LAMS before 3.1 that allows a remote attacker to introduce arbitrary JavaScript via manipulation of an unsanitized GET parameter during a forgotPasswordChange.jsp?key= password change...

CVE-2018-12090

LAMS prior to 3.1 is affected by an unauthenticated reflected XSS that allows injection of arbitrary JavaScript via an unsanitized GET parameter in forgotPasswordChange.jsp?key=. This is triggered through remote access without authentication; impact is confined to script execution in the victim’s...

CVE-2018-3735

bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template...

CVE-2018-3735

bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template...

Cross site scripting

bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template...

CVE-2018-3735

bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template...

PT-2018-16159 · Bracket · Bracket-Template

Name of the Vulnerable Software and Affected Versions: bracket-template affected versions not specified Description: The issue is related to reflected XSS, which can occur when a variable passed via a GET parameter is used in a template. Recommendations: At the moment, there is no information abo...

CVE-2018-10746

An issue was discovered on D-Link DSL-3782 EU 1.01 devices. An authenticated user can pass a long buffer as a 'get' parameter to the '/userfs/bin/tcapi' binary in the Diagnostics component using the 'get ' function and cause memory corruption. Furthermore, it is possible to redirect the flow of t...

Cross-Site Scripting

Overview All versions of bracket-template are vulnerable to stored cross-site scripting XSS. This is exploitable when a variable passed in via a GET parameter is used in a template. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use...

LocalTapiola: Reflected XSS of bbe-child-starter Theme via "value"-GET-parameter

This bug is related to 324442. And xss in other url. poc: https://www.lahitapiolarahoitus.fi/wp-content/themes/bbe-child-starter/bbe-engine/assets/actions/bbeopenhtmleditorpopup.php?attribute=%27%3C/script%3E%3Cbody%20onload&value=alertdocument.cookie Impact -Make admin-user run malicious...

PT-2018-3910 · D Link · D-Link Dsl-3782

Name of the Vulnerable Software and Affected Versions: D-Link DSL-3782 EU version 1.01 Description: An issue in the Diagnostics component of the D-Link DSL-3782 EU device allows an authenticated user to cause memory corruption by passing a long buffer as a get parameter to the /userfs/bin/tcapi...