Adrenalin eSystems HRMS Software Cross-Site Scripting Vulnerability

Adrenalin eSystems HRMS Software is a human resource management system from Adrenalin eSystems India. A cross-site scripting vulnerability exists in the RPT/SSRSDynamicEditReports.aspx page in Adrenalin eSystems HRMS Software version 5.4. A remote attacker can exploit this vulnerability to inject...

CVE-2019-9961

A cross-site scripting XSS vulnerability in ressource view in core/modules/resource/RESOURCEVIEW.php in Wikindx prior to version 5.7.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

Cross site scripting

A cross-site scripting XSS vulnerability in ressource view in core/modules/resource/RESOURCEVIEW.php in Wikindx prior to version 5.7.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter...

CVE-2018-12653

A Reflected Cross Site Scripting XSS vulnerability exists in Adrenalin HRMS 5.4.0. An attacker can input malicious JavaScript code in /RPT/SSRSDynamicEditReports.aspx via 'ReportId' parameter...

Desdev DedeCMS Arbitrary Password Reset Vulnerability

Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has content publishing , content management , content editing and content retrieval functions. A security vulnerability exists in th...

CVE-2019-10014

In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated...

CVE-2019-9925

S-CMS PHP v1.0 has XSS in 4.edu.php via the Sid parameter...

Kingcomposer Cross-Site Scripting Vulnerability

WordPress plugin KingComposer is a professional backend and frontend page builder plugin. A cross-site scripting vulnerability exists in the wp-admin/admin.php?page=kc-mapper page in version 2.7.6 of the WordPress kingcomposer plugin. A remote attacker can exploit the vulnerability to execute...

CVE-2018-20556

SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the bookingid parameter...

CVE-2018-18798

Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.php?view=view, and user/index.php?view=view...

CVE-2018-18798

Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.php?view=view, and user/index.php?view=view...

Sql injection

A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication...

CVE-2018-17415

zzcms V8.3 has a SQL injection in /user/zselite.php via the id parameter...

Sql injection

zzcms V8.3 has a SQL injection in /user/zselite.php via the id parameter...

CVE-2018-17415

zzcms V8.3 has a SQL injection in /user/zselite.php via the id parameter...

CVE-2018-17415

zzcms V8.3 has a SQL injection in /user/zselite.php via the id parameter...

CVE-2019-9594

BlueCMS 1.6 allows SQL Injection via the userid parameter in an uploads/admin/user.php?act=edit request...

Design/Logic Flaw

In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter in conjunction with the id parameter in a updjxcode=true action to the ndxzstudio/?a=system URI...

CVE-2019-8935

Collabtive 3.1 allows XSS via the manageuser.php?action=profile id parameter...

CVE-2019-7332

Reflected Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'eid' aka Event ID parameter value in the view download download.php because proper filtration is omitted...