PT-2025-42436

Name of the Vulnerable Software and Affected Versions Sergestec Exito version 8.0 Description A stored Cross-Site Scripting XSS issue exists in Sergestec Exito version 8.0. The issue is due to insufficient validation of user-supplied data. A malicious user can exploit this by sending a POST reque...

CVE-2024-56199

phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content into the FAQ editor at "http://localhost/admin/index.php?action=editentry", resulting in a complete disruption of the FAQ page's user...

CVE-2024-8146: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in code-projects Pharmacy Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /index.php?action=editSalesman. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The...

CVE-2023-7189: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical was found in S-CMS up to 2.0build20220529-20231006. Affected by this vulnerability is an unknown functionality of the file /s/index.php?action=statistics. The manipulation of the argument lid leads to sql injection. The exploit has been disclosed to the publ...

CVE-2023-49967

Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc...

CVE-2023-49967

Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc...

CVE-2023-49967

Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc...

CVE-2023-49967

Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc...

PT-2023-27616 · Phpjabbers · Phpjabbers Fundraising Script

Name of the Vulnerable Software and Affected Versions: PHPJabbers Fundraising Script version 1.0 Description: The issue is related to Cross Site Scripting XSS via the action parameter of "index.php". This allows for potential malicious script execution. The estimated number of potentially affecte...

PT-2022-11474

Name of the Vulnerable Software and Affected Versions SEOmatic plugin version 3.4.10 for Craft CMS 3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script via a GET to "/index.php?action=seomatic/file/seo-file-link" with url parameter containing the...

PT-2021-20133

Name of the Vulnerable Software and Affected Versions Wikindx versions prior to 5.7.0 Wikindx versions 6.x through 6.4.0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the message parameter to "index.php?action=initLogon" or...

PT-2020-12798

Name of the Vulnerable Software and Affected Versions Open Upload versions 0.4.3 and earlier Description The issue allows for XSS exploitation via the "index.php?action=u" endpoint, specifically through the filename field. This can lead to malicious script execution. Recommendations For Open Uplo...

CVE-2013-7468

Simple Machines Forum SMF 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter...

PT-2019-7017

Name of the Vulnerable Software and Affected Versions Simple Machines Forum SMF version 2.0.4 Description The issue allows PHP code injection through the index.php?action=admin;area=languages;sa=editlang API endpoint, specifically via the dictionary parameter. Recommendations For version 2.0.4,...

CVE-2019-7721

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

CVE-2019-7721

lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters...

PT-2019-18723

Name of the Vulnerable Software and Affected Versions nc-cms version 3.5 Description The issue allows for the upload of .php files. This is achieved through the index.php?action=save endpoint, utilizing the name and editordata parameters. Recommendations For nc-cms version 3.5, restrict access to...

PT-2018-14707

Name of the Vulnerable Software and Affected Versions nc-cms versions prior to 2017-03-10 Description The issue allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature. This can be achieved by uploading a file with a .php filename and setting the Content-Type ...

CVE-2018-18874: Unrestricted Upload of File with Dangerous Type

nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature, with a .php filename and "Content-Type: application/octet-stream" to the index.php?action=filemanagerupload URI...

CVE-2018-18361

An issue was discovered in nc-cms through 2017-03-10. index.php?action=edithtml allows XSS via the name parameter, as demonstrated by a value beginning with homecontent and containing a crafted SRC attribute of an IMG element...