6824 matches found
CVE-2020-23977
KandNconcepts Club CMS 1.1 and 1.2 has cross site scripting via the 'team.php,player.php,club.php' id parameter...
CVE-2020-23973
KandNconcepts Club CMS 1.1 and 1.2 has SQL Injection via the 'team.php,player.php,club.php' id parameter...
Cross site scripting
KandNconcepts Club CMS 1.1 and 1.2 has cross site scripting via the 'team.php,player.php,club.php' id parameter...
Sql injection
KandNconcepts Club CMS 1.1 and 1.2 has SQL Injection via the 'team.php,player.php,club.php' id parameter...
CVE-2020-23981
13enforme CMS 1.0 has Cross Site Scripting via the "content.php" id parameter...
CVE-2020-23981
CVE-2020-23981 affects 13enforme CMS 1.0 with a Cross Site Scripting flaw in the content.php id parameter. The NVD entry lists CVSSv2/3.1 base scores of 4.3 (MEDIUM) and 6.1 (MEDIUM) respectively, indicating potential impact to confidentiality and integrity. No vendor/version-specific remediation...
CVE-2020-23977
KandNconcepts Club CMS 1.1 and 1.2 has cross site scripting via the 'team.php,player.php,club.php' id parameter...
CVE-2020-23975
Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has cross site scripting via the 'search.php' id parameter...
CVE-2020-23975
CVE-2020-23975 affects Webexcels Ecommerce CMS 2.x (2017–2020). The vulnerability is a cross-site scripting flaw exploitable via the id parameter in search.php. No detailed exploit vectors or patch information are provided in the connected documents; remediation details are not stated. In summary...
CVE-2020-23973
KandNconcepts Club CMS 1.1 and 1.2 has SQL Injection via the 'team.php,player.php,club.php' id parameter...
NeDi Consulting NeDi Cross-Site Scripting Vulnerability (CNVD-2020-44579)
NeDi Consulting NeDi is a suite of open source software that supports the discovery and mapping of network devices from the Swiss company NeDi Consulting. A cross-site scripting vulnerability exists in NeDi Consulting NeDi version 1.9C. The vulnerability can be exploited to execute arbitrary...
SQL Injection
Apache SkyWalking is vulnerable to SQL injection. The function getLinearIntValues in H2MetricsQueryDAO.java does not sanitize the user-provided ID parameter to the SQL query StringBuilder when H2/MySQL/TiDB is used as storage, allowing an attacker to provide arbitrary string to construct maliciou...
SQL Injection Vulnerability in Exam Teacher Side Parameter id of Qixing Exam System of Shanghai Tsuenlu Software Development Studio
Exam System Exam is a compact exam system for internal corporate use for employee exams. Shanghai Tsuen Road Software Development Studio Qixing Exam System Exam teacher-side parameter id there is a SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive information in...
CVE-2020-14443
A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter...
UBUNTU-CVE-2020-14443
A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter...
CVE-2020-14443
A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter...
Virtual Airlines Manager 2.6.2 - 'notam' SQL Injection
Exploit Title: Virtual Airlines Manager 2.6.2 - 'notam' SQL Injection Date: 2020-06-07 Exploit Author: Pankaj Kumar Thakur Vendor Homepage: http://virtualairlinesmanager.net/ Dork: inurl:notamid= Affected Version: 2.6.2 Tested on: Ubuntu CVE : N/A Vulnerable parameter -------------------...
CVE-2020-11530
A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter supplied to getscript/index.php, and allows an attacker to execute arbitrary SQL queries in the context of the WP database user...
Sql injection
A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. The vulnerability is introduced in the id GET parameter supplied to getscript/index.php, and allows an attacker to execute arbitrary SQL queries in the context of the WP database user...