13398 matches found
CVE-2021-37293: Improper Limitation of a Pathname to a Restricted Directory
A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in index.php...
Cross site request forgery (csrf)
qdPM 9.2 allows Cross-Site Request Forgery CSRF via the index.php/myAccount/update URI...
CVE-2022-26180
The CVE-2022-26180 describes a CSRF vulnerability in qdPM 9.2 that can be exploited via the index.php/myAccount/update URI due to lack of CSRF token validation. Impact is high (C/H/I/A = High) with CVSS 3.1 base score 8.8; basic user interaction required (per the NVD entry). Exploitation details ...
CVE-2022-28002
Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?page=home...
PT-2022-18386
Name of the Vulnerable Software and Affected Versions Ecommece-Website version 1.1.0 Description The issue allows attackers to execute arbitrary code via a crafted PHP file, exploiting an arbitrary file upload vulnerability. This is achieved through the "/admin/index.php?slides" API endpoint...
CVE-2022-27346: Unrestricted Upload of File with Dangerous Type
Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...
CVE-2022-28002: Files or Directories Accessible to External Parties
Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?page=home...
CVE-2022-26180: Cross-Site Request Forgery (CSRF)
qdPM 9.2 allows Cross-Site Request Forgery CSRF via the index.php/myAccount/update URI...
PT-2022-18741
Name of the Vulnerable Software and Affected Versions Movie Seat Reservation version 1 Description The issue is related to a SQL injection vulnerability. It affects the "/index.php?page=reserve" API endpoint via the id parameter. Recommendations For Movie Seat Reservation version 1, as a temporar...
PT-2022-18742
Name of the Vulnerable Software and Affected Versions Movie Seat Reservation version 1 Description The issue is related to an unauthenticated file disclosure vulnerability. This vulnerability can be exploited via the "/index.php?page=home" API endpoint. Recommendations For Movie Seat Reservation...
CVE-2022-28001: Improper Neutralization of Special Elements used in an SQL Command
Movie Seat Reservation v1 was discovered to contain a SQL injection vulnerability at /index.php?page=reserve via the id parameter...
CVE-2022-27108
OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...
PT-2022-18225
Name of the Vulnerable Software and Affected Versions OrangeHRM version 4.10 Description The issue allows any user to create a timesheet in another user's account due to an Insecure Direct Object Reference IDOR via the endpoint "symfony/web/index.php/time/createTimesheet". Recommendations For...
CVE-2022-27108: Authorization Bypass Through User-Controlled Key
OrangeHRM 4.10 is vulnerable to Insecure Direct Object Reference IDOR via the end point symfony/web/index.php/time/createTimesheet. Any user can create a timesheet in another user's account...
CVE-2022-27436: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in /public/admin/index.php?adduser at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username text field...
PT-2022-18426
Name of the Vulnerable Software and Affected Versions Ecommerce-Website version 1.1.0 Description The issue allows attackers to upload a webshell via the Product Image component due to an unrestricted file upload at the "/public/admin/index.php?add product" API endpoint. Recommendations For...
PT-2022-18427
Name of the Vulnerable Software and Affected Versions Ecommerce-Website version 1.1.0 Description A cross-site scripting XSS issue exists in the /public/admin/index.php?add user endpoint, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username...
CVE-2021-43478
A vulnerability exists in Hoosk 1.8.0 in /install/index.php, due to a failure to check if config.php already exists in the root directory, which could let a malicious user reinstall the website...