13400 matches found
CVE-2021-44082: Improper Neutralization of Input During Web Page Generation
textpattern 4.8.7 is vulnerable to Cross Site Scripting XSS via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger remote code execution by uploading a webshell. To do so they must first steal the CSRF token before submitting a file upload request...
CVE-2022-26980
Teampass 2.1.26 allows reflected XSS via the index.php PATHINFO...
CVE-2022-26980
Teampass 2.1.26 allows reflected XSS via the index.php PATHINFO...
CVE-2022-26980
Teampass 2.1.26 allows reflected XSS via the index.php PATHINFO...
CVE-2022-26980
Teampass 2.1.26 allows reflected XSS via the index.php PATHINFO...
CVE-2022-26980
CVE-2022-26980 affects Teampass 2.1.26 and is described as a reflected XSS vulnerability via the index.php PATH_INFO. The linked sources corroborate a reflected XSS issue but do not provide an official patch version or remediation in the supplied documents. Documented CVSS scores from NVD (2.0/3....
CVE-2022-26980: Improper Neutralization of Input During Web Page Generation
Teampass 2.1.26 allows reflected XSS via the index.php PATHINFO...
PT-2022-18159
Name of the Vulnerable Software and Affected Versions Teampass version 2.1.26 Description The issue allows for reflected XSS via the "index.php" PATH INFO. This can be exploited when someone opens a link to the Teampass Password Manager index page that contains a malicious payload. Recommendation...
Sql injection
An issue was discovered in ApiManager 1.1. there is sql injection vulnerability that can use in /index.php?act=api&tag=8...
CVE-2021-43700
An issue was discovered in ApiManager 1.1. there is sql injection vulnerability that can use in /index.php?act=api&tag=8...
PT-2022-11886
Name of the Vulnerable Software and Affected Versions ApiManager version 1.1 Description An issue was discovered in ApiManager, which is a sql injection vulnerability. This vulnerability can be exploited through the "/index.php?act=api&tag=8" API endpoint. Recommendations For ApiManager version...
CVE-2021-43700: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in ApiManager 1.1. there is sql injection vulnerability that can use in /index.php?act=api&tag=8...
CVE-2021-42194
The wechatreturn function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml load String function, which itself does not prohibit external entities, triggering a XML external entity XXE injection vulnerability...
CVE-2022-25481
ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode...
ThinkPHP 安全漏洞
ThinkPHP is a PHP-based, open source, lightweight web application development framework from China's Top Thinking Information Technology Company. A security vulnerability exists in ThinkPHP Framework v5.0.24, which stems from the lack of configuration of the PATHINFO parameter. An attacker can...
PT-2022-11556
Name of the Vulnerable Software and Affected Versions EyouCms version 1.5.4-UTF8-SP3 Description The issue arises from the wechat return function in /controller/Index.php, which passes user input directly into the simplexml load string function without prohibiting external entities. This triggers...
CVE-2021-42194: Improper Restriction of XML External Entity Reference
The wechatreturn function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml load String function, which itself does not prohibit external entities, triggering a XML external entity XXE injection vulnerability...
CVE-2022-25481: Exposure of Resource to Wrong Sphere
ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode...
CVE-2021-45791
CVE-2021-45791 affects Slims8 Akasia 8.3.1. A SQL injection exists in multiple admin modules (bibliography, member_type, user_group, membership index) via the dir parameter, due to insufficient input escaping/validation. Exploitation is described as feasible by remotely authenticated librarian us...