1215 matches found
PT-2024-24242 · Italtel · Italtel Embrace
Name of the Vulnerable Software and Affected Versions: Italtel Embrace version 1.6.4 Description: An issue was discovered in the product where it does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter, whic...
CVE-2024-4860
The 'WordPress RSS Aggregator' WordPress Plugin, versions 4.23.9 are affected by a Cross-Site Scripting XSS vulnerability due to the lack of sanitization of the 'noticeid' GET parameter...
CVE-2024-4860
CVE-2024-4860 affects the WordPress plugin RSS Aggregator (WP RSS Aggregator) for versions < 4.23.9. The issue is a Cross‑Site Scripting (XSS) vulnerability caused by insufficient sanitization of the notice_id GET parameter. Connected sources confirm the detail and note the specific affected r...
The vulnerability in the script htdocs/webinc/js/bsc_sms_inbox.php of the D-Link DIR-845L router’s microprogramming software allows a attacker to perform XSS attacks.
The vulnerability in the script htdocs/webinc/js/bscsmsinbox.php of the D-Link DIR-845L router operating system allows an attacker to exploit the system by manipulating the $GET"Treturn" parameter during page processing. Exploiting this vulnerability enables a remote attacker to perform XSS attac...
osCommerce 4 Cross Site Scripting
Exploit Title: osCommerce 4 - Reflected XSS Exploit Author: skalvin Date: 22/04/2024 Vendor: osCommerce ltd. Vendor Homepage: https://www.oscommerce.com/ Software Link: https://demo.oscommerce.com/ Demo Link: https://demo.oscommerce.com/furniture/ Tested on: Windows 11 Pro Impact: Manipulate the...
CVE-2024-30214
CVE-2024-30214 concerns SAP Business Connector. The connected documents confirm a cross-site scripting (XSS) vulnerability where an attacker with high privileges can append a malicious GET query parameter to Service invocations that are reflected in the server response, potentially allowing clien...
The vulnerability of the virtual learning environment Moodle, related to the lack of security measures for the website structure, allows attackers to gain access to read, modify, or delete data, as well as execute cross-site attacks.
The vulnerability in the virtual training environment Moodle is related to the lack of measures taken to protect the structure of the web page during the processing of the GET /?lang= parameter. Exploiting this vulnerability can allow a malicious actor to gain access to read, modify, or delete...
CVE-2024-2669 Campcodes Online Job Finder System GET Parameter controller.php sql injection
A vulnerability was found in Campcodes Online Job Finder System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/employee/controller.php of the component GET Parameter Handler. The manipulation of the argument EMPLOYEEID leads to sql injection. The...
BIT-PRESTASHOP-2023-30151
A SQL injection vulnerability in the Boxtal envoimoinscher module for PrestaShop, after version 3.1.10, allows remote attackers to execute arbitrary SQL commands via the key GET parameter...
The vulnerability of the sub_41C488() function in D-Link DIR-823G router’s software allows a hacker to induce a service failure.
The vulnerability of the sub41C488 function in D-Link DIR-823G router microprogramming software is related to errors in pointer manipulation during the processing of the GET parameter. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2024-25893
ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection Time-based via the CurrentFundraiser GET parameter...
CVE-2024-25897
ChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection Time-based via the CurrentFundraiser GET parameter...
Sql injection
ChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection Time-based via the CurrentFundraiser GET parameter...
CVE-2024-25892
ChurchCRM 5.5.0 ConfirmReport.php is vulnerable to Blind SQL Injection Time-based via the familyId GET parameter...
CVE-2024-25891
ChurchCRM 5.5.0 FRBidSheets.php is vulnerable to Blind SQL Injection Time-based via the CurrentFundraiser GET parameter...
CVE-2024-25893
ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection Time-based via the CurrentFundraiser GET parameter...
CVE-2024-24572 facileManager Authenticated Variable Manipulation leading to SQL Injection
facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, the $REQUEST global array was unsafely called inside an extract function in admin-logs.php. The PHP file fm-init.php prevents arbitrary manipulation of $SESSION via the GET/POST parameters...
PT-2024-4081 · Unknown · Sourcecodester School Task Manager
Name of the Vulnerable Software and Affected Versions: Sourcecodester School Task Manager version 1.0 Description: The issue is related to a lack of protection against SQL injection attacks. An attacker can exploit this to gain unauthorized access to the application's database through the subject...