13398 matches found
CVE-2021-39408
Cross Site Scripting XSS vulnerability exists in Online Student Rate System 1.0 via the page parameter on the index.php file...
CVE-2021-39408
Cross Site Scripting XSS vulnerability exists in Online Student Rate System 1.0 via the page parameter on the index.php file...
CVE-2021-39408
The CVE-2021-39408 entry applies to Online Student Rate System v1.0. Affected: index.php page parameter handling in the application. Root cause: lack of input validation/escaping of user-supplied data in the page parameter leading to Cross-Site Scripting (XSS). Impact: attacker could cause client...
CVE-2022-30117
Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changin...
PT-2022-10910
Name of the Vulnerable Software and Affected Versions Online Student Rate System version 1.0 Description A Cross Site Scripting XSS issue exists via the page parameter on the "index.php" file. This allows for potential malicious script execution. Recommendations For Online Student Rate System...
Online Student Rate System 跨站脚本漏洞
Online Student Rate System is an online grading system for students. v1.0 of the Online Student Rate System is vulnerable to a cross-site scripting vulnerability that stems from a lack of validation filtering of user-supplied data and output data in the page parameter of the index.php file. An...
PT-2022-20008
Name of the Vulnerable Software and Affected Versions Concrete versions 8.5.7 and below Concrete versions 9.0 through 9.0.2 Description The issue allows traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing...
CVE-2021-39408: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability exists in Online Student Rate System 1.0 via the page parameter on the index.php file...
CVE-2022-30117: Improper Limitation of a Pathname to a Restricted Directory
Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changin...
Cross site scripting
PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=authorsee request to index.php...
Cross-site Scripting (XSS)
microweber/microweber is vulnerable to cross-site scriptingXSS attacks. A remote attacker is able to inject and execute malicious javascript via bypassing XSS filters in index.php, resulting in cookie stealing and account takeover...
CVE-2022-34328: Improper Neutralization of Input During Web Page Generation
PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=authorsee request to index.php...
CVE-2022-31062
Impact A plugin public script can be used to read content of system files. Patches Upgrade to version 1.0.2. Workarounds "b/deploy/index.php" file can be deleted if deploy feature is not used...
CVE-2022-31062: Improper Limitation of a Pathname to a Restricted Directory
Impact A plugin public script can be used to read content of system files. Patches Upgrade to version 1.0.2. Workarounds b/deploy/index.php file can be deleted if deploy feature is not used...
PT-2022-20711
Name of the Vulnerable Software and Affected Versions Online Ordering System version 2.3.2 Description The issue is related to a SQL injection vulnerability. It can be exploited via the "/ordering/index.php?q=category&search=" API endpoint. The search parameter is vulnerable. Recommendations For...
PT-2022-20712
Name of the Vulnerable Software and Affected Versions Online Ordering System version 2.3.2 Description The issue is related to a SQL injection vulnerability. It can be exploited via the "/ordering/admin/store/index.php?view=edit&id=" API endpoint, specifically through the id variable. This...
CVE-2022-31357: Improper Neutralization of Special Elements used in an SQL Command
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=...
CVE-2022-31355: Improper Neutralization of Special Elements used in an SQL Command
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/index.php?q=category&search=...