707 matches found
w2wiki Cross-site Scripting Vulnerabilities
w2wiki is a web-based wiki-like notepad developed by Steven Frank. A security vulnerability exists in w2wiki, which originates in the toHTML function of the index.php file of the component Markdown Handler, where a parameter query leads to cross-site scripting...
PT-2022-8621 · Unknown · Zhimengzhe Ibarn
Name of the Vulnerable Software and Affected Versions: zhimengzhe iBarn version 1.5 Description: The issue allows remote attackers to run arbitrary code via avatar upload to "index.php". This is due to a file upload vulnerability in the upload function in action/Core.class.php. Recommendations: F...
UBUNTU-CVE-2022-36180
Fusiondirectory 1.3 is vulnerable to Cross Site Scripting XSS via /fusiondirectory/index.php?message=injection, /fusiondirectory/index.php?message=invalidparameter&plug=Injection, /fusiondirectory/index.php?signout=1&message=injection&plug=106...
Online Examination System Cross-Site Script Vulnerabilities
Sourcecodester SourceCodester Online Examination System is an online examination system from Sourcecodester, Inc. A cross-site scripting vulnerability exists in version 1.0 of the Online Examination System, which stems from its index.php component that allows an attacker to implement reflective...
ClipperCMS code-related vulnerabilities
ClipperCMS is a content management system CMS from the ClipperCMS team. A security vulnerability exists in ClipperCMS version 1.3.3, which originates from the inclusion of server-side request forgery SSRF via the rssurlnews parameter in /manager/index.php...
CVE-2022-41495
ClipperCMS 1.3.3 was discovered to contain a Server-Side Request Forgery SSRF via the rssurlnews parameter at /manager/index.php...
Metinfo CMS SQL Injection
The vulnerability of the index.php script implementation in the Metinfo CMS system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...
CVE-2022-40359
Cross site scripting XSS vulnerability in kfm through 1.4.7 via crafted GET request to /kfm/index.php...
CVE-2022-37190
CuppaCMS 1.0 is vulnerable to Remote Code Execution RCE. An authenticated user can control both parameters action and function from "/api/index.php...
CVE-2022-37190
CuppaCMS 1.0 is vulnerable to Remote Code Execution RCE. An authenticated user can control both parameters action and function from "/api/index.php...
CVE-2022-37191
The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using function parameter value as LFI payload...
CVE-2022-36254
Multiple persistent cross-site scripting XSS vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers to inject arbitrary web script or HTML via multiple parameters such as "fullname"...
Online Admission System Cross-Site Script Vulnerabilities
Online Admission System is an online admission system by the individual developer RASHMI KUMARI. A cross-site scripting vulnerability exists in the Online Admission System, which originates from an unknown part of the file /index.php being affected, where manipulation of the parameter studentadd...
CVE-2022-2677
A vulnerability was found in SourceCodester Apartment Visitor Management System 1.0. It has been classified as critical. This affects an unknown part of the file index.php. The manipulation of the argument username with the input ' AND SELECT 4955 FROM SELECTSLEEP5RSzF AND 'htiy'='htiy leads to s...
PT-2022-17871 · Unknown · Sourcecodester Online Admission System
Name of the Vulnerable Software and Affected Versions: SourceCodester Online Admission System affected versions not specified Description: A problematic issue was found in the SourceCodester Online Admission System, affecting an unknown function of the file index.php. The manipulation of the eid...
CVE-2022-34611
A cross-site scripting XSS vulnerability in /index.php/?p=report of Online Fire Reporting System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "Contac " text field...
CVE-2017-20126
A vulnerability was found in KB Affiliate Referral Script 1.0. It has been classified as critical. This affects an unknown part of the file /index.php. The manipulation of the argument username/password with the input 'or''=' leads to sql injection. It is possible to initiate the attack remotely...
CVE-2022-31856
Newsletter Module v3.x was discovered to contain a SQL injection vulnerability via the zemeznewsletteremail parameter at /index.php...
GUnet Open eClass Platform path traversal vulnerability
GUnet Open eClass Platform is an integrated course management system for GUnet eClass. A security vulnerability exists in GUnet Open eClass Platform aka openeclass version v3.12.4 and earlier. An attacker can exploit this vulnerability to read arbitrary files via directory traversal via the jmpat...