13398 matches found
PT-2022-20690
Name of the Vulnerable Software and Affected Versions Online Ordering System By janobe version 2.3.2 Description The issue is related to SQL Injection. It affects the /ordering/admin/products/index.php?view=edit&id= API endpoint, where the id parameter is vulnerable. Recommendations For version...
CVE-2022-31338: Improper Neutralization of Special Elements used in an SQL Command
Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/user/index.php?view=edit&id=...
CVE-2022-30352: Improper Neutralization of Special Elements used in an SQL Command
phpABook 0.9i is vulnerable to SQL Injection due to insufficient sanitization of user-supplied data in the "authuser" parameter in index.php script...
PT-2022-20072
Name of the Vulnerable Software and Affected Versions phpABook version 0.9i Description The issue arises from insufficient sanitization of user-supplied data in the auth user parameter, leading to SQL Injection. This occurs in the index.php script. Recommendations For phpABook version 0.9i,...
NukeViet Cross-Site Request Forgery (CSRF)
clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...
GHSA-J4FQ-3FM7-WH5V Magento arbitrary PHP code execution via the productData parameter
The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition CE before 1.9.2.1 and Enterprise Edition EE before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData...
Magento arbitrary PHP code execution via the productData parameter
The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition CE before 1.9.2.1 and Enterprise Edition EE before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData...
GHSA-G32Q-4FHF-CQ72 ImpressCMS XSS
ImpressCMS 1.3.10 has XSS via the PATHINFO to htdocs/install/index.php, htdocs/install/pagelangselect.php, or htdocs/install/pagemodcheck.php...
PT-2022-20758
Name of the Vulnerable Software and Affected Versions Inout Blockchain AltExchanger version 1.2.1 Description The issue allows for SQL injection through the inoutio language cookie in the index.php/home/about endpoint. This can potentially lead to unauthorized access or manipulation of data...
PT-2022-20757
Name of the Vulnerable Software and Affected Versions Inout Blockchain AltExchanger version 1.2.1 Description The issue allows for SQL injection in the marketcurrency parameter of the "index.php/coins/update marketboxslider" API endpoint. This could potentially lead to unauthorized access or...
CVE-2022-31489: Improper Neutralization of Special Elements used in an SQL Command
Inout Blockchain AltExchanger 1.2.1 allows index.php/home/about inoutiolanguage cookie SQL injection...
CVE-2022-31488: Improper Neutralization of Special Elements used in an SQL Command
Inout Blockchain AltExchanger 1.2.1 allows index.php/coins/updatemarketboxslider marketcurrency SQL injection...
Dolibarr ERP and CRM SQLi
Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php searchsupervisor and searchstatut parameters...
GHSA-V3M8-7H3P-6J5M Dolibarr ERP and CRM SQLi
Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php searchsupervisor and searchstatut parameters...
Cross site scripting
atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter...
CVE-2022-30776
Affected software: Atmail 6.5.0. Vulnerability: Cross-site scripting (XSS) via the index.php/admin/index/ 'error' parameter. Root cause: Improper handling/input validation of the error parameter leads to script execution in the victim’s browser. Impact (as described): attackers could execute mali...
CVE-2022-30776: Improper Neutralization of Input During Web Page Generation
atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter...
PT-2022-20310
Name of the Vulnerable Software and Affected Versions atmail version 6.5.0 Description The issue allows for XSS via the "index.php/admin/index/" endpoint, specifically through the error parameter. Recommendations For atmail version 6.5.0, consider restricting access to the "index.php/admin/index/...
GHSA-726G-CGCQ-4XW8 Dolibarr Cross-Site Scripting (XSS) vulnerability
Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting XSS vulnerabilities in versions before 5.0.4: index.php leftmenu parameter, core/ajax/box.php PATHINFO, product/stats/card.php type parameter, holiday/list.php monthcreate, monthstart, and monthend parameters, and don/card.ph...