6679 matches found
CVE-2016-10939
The xtremelocator plugin 1.5 for WordPress has SQL injection via the id parameter...
CVE-2019-15829
The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS...
OpenEMR Cross-Site Scripting Vulnerability (CNVD-2019-28409)
OpenEMR is a medical practice management software that also supports electronic medical records EMR. A cross-site scripting vulnerability in the patientid parameter in controller.php in OpenEMR 5.0.1 and earlier versions can be exploited by an attacker to execute arbitrary code in the context of ...
OpenEMR Cross-Site Scripting Vulnerability (CNVD-2019-28408)
OpenEMR is a medical practice management software that also supports electronic medical records EMR. A cross-site scripting vulnerability in the docid parameter in controller.php in OpenEMR 5.0.1 and earlier versions can be exploited by an attacker to execute arbitrary code in the context of a us...
OpenEMR Cross-Site Scripting Vulnerability (CNVD-2019-28406)
OpenEMR is a medical practice management software that also supports electronic medical records EMR. A cross-site scripting vulnerability in the foreignid parameter in controller.php in OpenEMR 5.0.1 and earlier versions can be exploited by an attacker to execute arbitrary code in the context of ...
CVE-2019-14937
REDCap before 9.3.0 allows time-based SQL injection in the edit calendar event via the calid parameter, such as calid=55 and sleep3 to Calendar/calendarpopupajax.php. The attacker can obtain a user's login sessionid from the database, and then re-login into REDCap to compromise all data...
CVE-2019-14696
Open-School 3.0, and Community Edition 2.3, allows XSS via the osv/index.php?r=students/guardians/create id parameter...
CVE-2019-14696
CVE-2019-14696 affects Open-School 3.0 and Community Edition 2.3, exposing a Cross-Site Scripting (XSS) flaw. The vulnerability occurs in the GET parameter osv/index.php?r=students/guardians/create id, allowing injection of arbitrary JavaScript in the victim’s browser. This could enable session h...
CVE-2019-9885
eClass platform ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenviewleft.php StudentID parameter...
Sql injection
Ovidentia 8.4.3 has SQL Injection via the id parameter in an index.php?tg=delegat&idx=mem request...
CVE-2019-13969
Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=uiset&m=admin&c=index&a=dogettextcontent&table=lang&field=1 request...
CVE-2019-13969
Metinfo 6.x allows SQL Injection via the id parameter in an admin/index.php?n=uiset&m=admin&c=index&a=dogettextcontent&table=lang&field=1 request...
CVE-2019-11827
Cross-site scripting XSS vulnerability in SYNO.NoteStation.Shard in Synology Note Station before 2.5.3-0863 allows remote attackers to inject arbitrary web script or HTML via the objectid parameter...
PT-2019-12512 · Synology · Note Station
Name of the Vulnerable Software and Affected Versions: Synology Note Station versions prior to 2.5.3-0863 Description: A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the object id parameter. Recommendations: For versions prior to 2.5.3-0863, update...
PT-2019-11675 · WordPress · Ultimate Member
Name of the Vulnerable Software and Affected Versions: Ultimate Member plugin version 2.39 Description: An issue in the Ultimate Member plugin for WordPress allows unauthorized modification of user profiles and cover pictures. Once connected, an attacker can modify the profile and cover picture o...
CVE-2018-17388
SQL Injection exists in Twilio WEB To Fax Machine System 1.0 via the email or password parameter to logincheck.php, or the id parameter to addemail.php or editcontent.php...
CVE-2018-17399
SQL Injection exists in the Jimtawl 2.2.7 component for Joomla! via the id parameter...
CVE-2018-17393
SQL Injection exists in HealthNode Hospital Management System 1.0 via the id parameter to dashboard/Patient/info.php or dashboard/Patient/patientdetails.php...