6680 matches found
CVE-2019-17604
An Insecure Direct Object Reference IDOR vulnerability in eyecomms eyeCMS through 2019-10-15 allows any candidate to change other candidates' personal information first name, last name, email, CV, phone number, and all other personal information by changing the value of the candidate id the id...
CVE-2019-18387
Sourcecodester Hotel and Lodge Management System 1.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the id parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details...
CVE-2019-17409
Reflected XSS exists in interface/forms/eyemag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter...
CVE-2019-17409
Reflected XSS exists in interface/forms/eyemag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter...
Cross site scripting
Reflected XSS exists in interface/forms/eyemag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter...
CVE-2019-17409
Reflected XSS exists in interface/forms/eyemag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter...
YouPHPTube 'id' Parameter SQL Injection Vulnerability
YouPHPTube is a PHP-based video website system. A SQL injection vulnerability exists in the 'id' parameter of the /plugin/ADServer/view/campaignsVideos.json file in YouPHPTube version 7.6. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based...
CVE-2019-17429
Adhouma CMS through 2019-10-09 has SQL Injection via the post.php pid parameter...
CVE-2019-15750
A Cross-Site Scripting XSS vulnerability in the blog function in SITOS six Build v6.2.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter...
Cross site scripting
A Cross-Site Scripting XSS vulnerability in the blog function in SITOS six Build v6.2.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter...
PT-2019-5822 · Zabbix +1 · Zabbix +1
Name of the Vulnerable Software and Affected Versions: Zabbix versions prior to 4.4 Description: An issue was discovered in "zabbix.php?action=dashboard.view&dashboardid=1" that allows an attacker to bypass the login page and access the dashboard page anonymously. The attacker can then create a...
Sql injection
In Metinfo 7.0.0beta, a SQL Injection was discovered in app/system/product/admin/productadmin.class.php via the admin/?n=product&c=productadmin&a=dopara&apptype=shop id parameter...
PT-2019-7395 · WordPress · Dynamic Widgets
Name of the Vulnerable Software and Affected Versions: dynamic-widgets plugin versions prior to 1.5.11 Description: The issue concerns a cross-site scripting XSS problem. It can be exploited via the "action=term tree" prefix or the widget id parameter in the "/wp-admin/admin-ajax.php" API endpoin...
CVE-2019-16194
SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svcid parameter in include/monitoring/status/Services/xml/makeXMLForOneService.php...
CVE-2016-10998
The ocim-mp3 plugin through 2016-03-07 for WordPress has wp-content/plugins/ocim-mp3/source/pages.php?id= XSS...
CVE-2016-10985
The echosign plugin before 1.2 for WordPress has XSS via the templates/addtemplates.php id parameter...
CVE-2016-10985
The echosign plugin before 1.2 for WordPress has XSS via the templates/addtemplates.php id parameter...
CVE-2016-10985
The echosign plugin before 1.2 for WordPress has XSS via the templates/addtemplates.php id parameter...