6679 matches found
Desdev DedeCMS Arbitrary Password Reset Vulnerability
Desdev DedeCMS Dream Weaving Content Management System is a PHP-based open-source content management system CMS of China Zhuozhuo network Desdev company. The system has content publishing , content management , content editing and content retrieval functions. A security vulnerability exists in th...
CVE-2019-10014
In DedeCMS 5.7SP2, member/resetpassword.php allows remote authenticated users to reset the passwords of arbitrary users via a modified id parameter, because the key parameter is not properly validated...
CVE-2019-9925
S-CMS PHP v1.0 has XSS in 4.edu.php via the Sid parameter...
Kingcomposer Cross-Site Scripting Vulnerability
WordPress plugin KingComposer is a professional backend and frontend page builder plugin. A cross-site scripting vulnerability exists in the wp-admin/admin.php?page=kc-mapper page in version 2.7.6 of the WordPress kingcomposer plugin. A remote attacker can exploit the vulnerability to execute...
CVE-2018-20556
SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the bookingid parameter...
CVE-2018-18798
Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.php?view=view, and user/index.php?view=view...
CVE-2018-18798
Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.php?view=view, and user/index.php?view=view...
Sql injection
A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication...
Sql injection
zzcms V8.3 has a SQL injection in /user/zselite.php via the id parameter...
CVE-2018-17415
zzcms V8.3 has a SQL injection in /user/zselite.php via the id parameter...
CVE-2018-17415
zzcms V8.3 has a SQL injection in /user/zselite.php via the id parameter...
CVE-2018-17415
zzcms V8.3 has a SQL injection in /user/zselite.php via the id parameter...
CVE-2019-9594
BlueCMS 1.6 allows SQL Injection via the userid parameter in an uploads/admin/user.php?act=edit request...
Design/Logic Flaw
In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter in conjunction with the id parameter in a updjxcode=true action to the ndxzstudio/?a=system URI...
CVE-2019-8935
Collabtive 3.1 allows XSS via the manageuser.php?action=profile id parameter...
CVE-2019-7332
Reflected Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'eid' aka Event ID parameter value in the view download download.php because proper filtration is omitted...
CVE-2019-7316
An issue was discovered in CSS-TRICKS Chat2 through 2015-05-05. The userid parameter in jumpin.php has a SQL injection vulnerability...
CVE-2019-6805
SQL Injection was found in S-CMS version V3.0 via the alipay/alipayapi.php Oid parameter...