Sql injection

SeaCms before v12.6 was discovered to contain a SQL injection vulnerability via the component /js/player/dmplayer/dmku/index.php...

CVE-2022-43256

SeaCms before v12.6 was discovered to contain a SQL injection vulnerability via the component /js/player/dmplayer/dmku/index.php...

CVE-2022-43256

SeaCms before v12.6 was discovered to contain a SQL injection vulnerability via the component /js/player/dmplayer/dmku/index.php...

CVE-2022-43256: Improper Neutralization of Special Elements used in an SQL Command

SeaCms before v12.6 was discovered to contain a SQL injection vulnerability via the component /js/player/dmplayer/dmku/index.php...

CVE-2022-43320

FeehiCMS v2.1.1 was discovered to contain a reflected cross-site scripting XSS vulnerability via the id parameter at /web/admin/index.php?r=log%2Fview-layer...

CVE-2022-43320: Improper Neutralization of Input During Web Page Generation

FeehiCMS v2.1.1 was discovered to contain a reflected cross-site scripting XSS vulnerability via the id parameter at /web/admin/index.php?r=log%2Fview-layer...

HTML Injection

froxlor is vulnerable to HTML Injection. The vulnerability exists due to index.php which allows an attacker to inject and execute malicious HTML content into the login webpage...

Cross site scripting

EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /module/reportevent/index.php...

CVE-2022-41432

EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /module/reportevent/index.php...

CVE-2022-41432: Improper Neutralization of Input During Web Page Generation

EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /module/reportevent/index.php...

CVE-2022-3878: Improper Neutralization

A vulnerability classified as critical has been found in Maxon ERP. This affects an unknown part of the file /index.php/purchaseorder/browsedata. The manipulation of the argument tbsearch leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the...

CVE-2022-43317: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in /hrm/index.php?msg of Human Resource Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2022-42923

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker with the role of student to perform a SQL injection on the 'id' parameter in the 'appCore/index.php?r=adm/mediagallery/delete'...

CVE-2022-42923 SQL injection in Forma LMS

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker with the role of student to perform a SQL injection on the 'id' parameter in the 'appCore/index.php?r=adm/mediagallery/delete'...

CVE-2022-42923: Improper Neutralization of Special Elements used in an SQL Command

Forma LMS on its 3.1.0 version and earlier is vulnerable to a SQL injection vulnerability. The exploitation of this vulnerability could allow an authenticated attacker with the role of student to perform a SQL injection on the 'id' parameter in the 'appCore/index.php?r=adm/mediagallery/delete'...

PT-2022-26783

Name of the Vulnerable Software and Affected Versions Rukovoditel version 3.2.1 Description A stored cross-site scripting XSS issue in the Global Entities feature, specifically at the "/index.php?module=entities/entities" endpoint, allows authenticated attackers to execute arbitrary web scripts o...

CVE-2022-39976: Improper Neutralization of Special Elements used in an SQL Command

School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /modules/announcement/index.php?view=edit&id=...

Cross site scripting

Online Examination System version 1.0 suffers from a cross site scripting vulnerability via index.php...

CVE-2022-42066

CVE-2022-42066 affects Online Examination System version 1.0, with a cross-site scripting vulnerability exploitable via index.php. The issue is a client-side input handling flaw that can expose confidentiality and integrity risks (per CVSS data: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation ...

PT-2022-26229 · Unknown · Online Examination System

Name of the Vulnerable Software and Affected Versions: Online Examination System version 1.0 Description: The issue is related to a cross-site scripting vulnerability. It can be exploited via the index.php file. Recommendations: For Online Examination System version 1.0, consider disabling access...