13411 matches found
CVE-2020-10218
The CVE-2020-10218 entry pertains to Sapplica Sentrifugo 3.2, where a Blind SQL Injection vulnerability exists in the index.php/holidaygroups/add id parameter caused by the HolidaydatesController.php addAction function. The issue allows an attacker to read data from the application’s database. Pu...
CVE-2020-10218: Improper Neutralization of Special Elements used in an SQL Command
A Blind SQL Injection issue was discovered in Sapplica Sentrifugo 3.2 via the index.php/holidaygroups/add id parameter because of the HolidaydatesController.php addAction function...
PT-2020-11979
Name of the Vulnerable Software and Affected Versions Sapplica Sentrifugo version 3.2 Description A Blind SQL Injection issue was discovered in the software. The issue is related to the addAction function in the HolidaydatesController.php file. It can be exploited via the id parameter in the...
CVE-2020-10415
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/index.php by adding a question mark ? followed by the payload...
CVE-2020-10415
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/index.php by adding a question mark ? followed by the payload...
CVE-2020-10415: Improper Neutralization of Input During Web Page Generation
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/index.php by adding a question mark ? followed by the payload...
Joomla! Component com_newsfeeds 1.0 - 'feedid' SQL Injection
Exploit Title: Joomla! Component comnewsfeeds 1.0 - 'feedid' SQL Injection Date: 2020-03-10 Author: Milad Karimi Software Link: Version: Category : webapps Tested on: windows 10 , firefox CVE : CWE-89 Dork: inurl:index.php?option=comnewsfeeds...
CVE-2015-7338
SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocationlongitude request to index.php...
CVE-2015-7338
SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocationlongitude request to index.php...
CVE-2015-7338: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocationlongitude request to index.php...
PT-2020-7882
Name of the Vulnerable Software and Affected Versions: AcyMailing Joomla Component versions prior to 4.9.5 Description: The issue is related to SQL Injection in the AcyMailing Joomla Component. It can be exploited via the exportgeolocorder in a geolocation longitude request to "index.php"...
60CycleCMS - news.php SQL Injection
60CycleCMS - news.php SQL Injection Exploit Title: 60CycleCMS - 'news.php' Multiple vulnerability Google Dork: N/A Date: 2020-02-10 Exploit Author: Unkn0wn Vendor Homepage: http://davidvg.com/ Software Link: https://www.opensourcecms.com/60cyclecms Version: 2.5.2 Tested on: Ubuntu CVE : N/A...
CVE-2020-10106
CVE-2020-10106 affects PHPGurukul Daily Expense Tracker System 1.0. The Red Hat/NVD entries confirm a SQL injection via the email parameter in index.php or register.php, enabling dumping of the MySQL database and bypassing the login prompt. The vulnerability is driven by improper handling of user...
PT-2020-11930
Name of the Vulnerable Software and Affected Versions PHPGurukul Daily Expense Tracker System version 1.0 Description The issue allows for SQL injection, as demonstrated by the email parameter in "index.php" or "register.php", enabling the dumping of the MySQL database and bypassing the login...
CVE-2020-10106: Improper Neutralization of Special Elements used in an SQL Command
PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to SQL injection, as demonstrated by the email parameter in index.php or register.php. The SQL injection allows to dump the MySQL database and to bypass the login prompt...
CVE-2018-19599: Improper Neutralization of Input During Web Page Generation
Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product...
PT-2020-8647
Name of the Vulnerable Software and Affected Versions: Monstra CMS version 1.6 Description: The issue allows for XSS via an uploaded SVG document to the "admin/index.php?id=filesmanager&path=uploads/" URI. It is noted that Monstra CMS is a discontinued product. Recommendations: For Monstra CMS...
CVE-2019-19134: Improper Neutralization of Input During Web Page Generation
The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of ...
CVE-2020-9341: Cross-Site Request Forgery (CSRF)
CandidATS 2.1.0 is vulnerable to CSRF that allows for an administrator account to be added via the index.php?m=settings&a=addUser URI...