CVE-2025-8976: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/index.php?module=content/post&type=post of the component Endpoint. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been...

CVE-2025-8521

A vulnerability, which was classified as problematic, has been found in givanz Vvveb up to 1.0.5. This issue affects some unknown processing of the file /vadmin123/index.php?module=settings/post-types of the component Add Type Handler. The manipulation leads to cross site scripting. The attack ma...

CVE-2025-8521: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, has been found in givanz Vvveb up to 1.0.5. This issue affects some unknown processing of the file /vadmin123/index.php?module=settings/post-types of the component Add Type Handler. The manipulation leads to cross site scripting. The attack ma...

CVE-2023-4559: Unrestricted Upload of File with Dangerous Type

A vulnerability, which was classified as critical, has been found in Bettershop LaikeTui. Affected by this issue is some unknown functionality of the file index.php?module=api&action=user&m=upload of the component POST Request Handler. The manipulation leads to unrestricted upload. The attack may...

PT-2023-15600

Name of the Vulnerable Software and Affected Versions Rukovoditel version 3.2.1 Description A remote code execution RCE vulnerability was discovered in the component "/rukovoditel/index.php?module=dashboard/ajax request". Recommendations For Rukovoditel version 3.2.1, consider disabling access to...

CVE-2022-45020: Improper Neutralization of Input During Web Page Generation

Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting XSS vulnerability in the component /rukovoditel/index.php?module=users/login. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted GET request...

CVE-2022-44948: Improper Neutralization of Input During Web Page Generation

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Entities Group feature at/index.php?module=entities/entitiesgroups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

PT-2022-27352

Name of the Vulnerable Software and Affected Versions Rukovoditel version 3.2.1 Description A stored cross-site scripting XSS issue was found in the /index.php?module=configuration/application endpoint, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload injected int...

PT-2022-27348

Name of the Vulnerable Software and Affected Versions Rukovoditel version 3.2.1 Description A stored cross-site scripting XSS issue was found in the Add New Field function at "/index.php?module=entities/fields&entities id=24". This allows attackers to execute arbitrary web scripts or HTML via a...

PT-2022-26783

Name of the Vulnerable Software and Affected Versions Rukovoditel version 3.2.1 Description A stored cross-site scripting XSS issue in the Global Entities feature, specifically at the "/index.php?module=entities/entities" endpoint, allows authenticated attackers to execute arbitrary web scripts o...

CVE-2020-19159: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF in LaikeTui v3 allows remote attackers to execute arbitrary code via the component '/index.php?module=member&action=add'...

CVE-2021-34128: Unrestricted Upload of File with Dangerous Type

LaikeTui 3.5.0 allows remote authenticated users to execute arbitrary PHP code by using index.php?module=system&action=pay to upload a ZIP archive containing a .php file, as demonstrated by the ../../../../phpinfo.php pathname...

PT-2021-3361

Name of the Vulnerable Software and Affected Versions LaikeTui version 3.5.0 Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a ZIP archive containing a .php file. This can be achieved by using the "index.php?module=system&action=pay" endpoint to...

CVE-2020-24877: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in zzzphp v1.8.0 through /form/index.php?module=getjson may lead to a possible access restriction bypass...

PT-2021-11077

Name of the Vulnerable Software and Affected Versions: zzzphp version 1.8.0 Description: A SQL injection issue may lead to a possible access restriction bypass. The /form/index.php?module=getjson endpoint is affected. Recommendations: For zzzphp version 1.8.0, consider restricting access to the...

PT-2020-13253

Name of the Vulnerable Software and Affected Versions Solis Miolo version 2.0 Description The issue allows for Directory Traversal via the "index.php?module=install&action=view&item=" endpoint. This could potentially allow an attacker to access sensitive files on the system. Recommendations For...

PT-2019-11993

Name of the Vulnerable Software and Affected Versions KBPublisher version 6.0.2.1 Description The issue concerns SQL Injection, which can be exploited through specific parameters in the application. The vulnerable parameters include entry id0 in the "admin/index.php?module=report" endpoint, id in...

CVE-2018-8047: Improper Neutralization of Input During Web Page Generation

vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting XSS vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List app parameter...

PT-2019-11144

Name of the Vulnerable Software and Affected Versions: vtiger CRM versions prior to 7.0.1 Description: The issue is a reflected Cross-Site Scripting XSS vulnerability that could allow remote unauthenticated attackers to inject arbitrary web script or HTML via the...

PT-2019-19860

Name of the Vulnerable Software and Affected Versions PilusCart version 1.4.1 Description The issue allows for a CSRF attack via the "index.php?module=users&action=newUser" endpoint, potentially leading to the addition of a new user with administrator privileges. Recommendations For PilusCart...