Cross-site Scripting (XSS)

Moodle is susceptible to cross-site scripting XSS attacks. The attacks are possible because the parameter passed to blog/index.php is not properly sanitized. It allows the attackers to inject arbitrary web script or HTML through it when Internet Explorer is used...

Sql injection

The VirtueMart comvirtuemart component 3.0.14 for Joomla! allows SQL injection by remote authenticated administrators via the virtuemartpaymentmethodid or virtuemartshipmentmethodid parameter to administrator/index.php...

Path Traversal

jokkedk/webgrind is vulnerable to path traversals. By using an absolute file path in the file parameter in index.php, attackers are able read an arbitrary file...

CVE-2016-10379: Improper Neutralization of Special Elements used in an SQL Command

The VirtueMart comvirtuemart component 3.0.14 for Joomla! allows SQL injection by remote authenticated administrators via the virtuemartpaymentmethodid or virtuemartshipmentmethodid parameter to administrator/index.php...

PT-2017-7893

Name of the Vulnerable Software and Affected Versions VirtueMart com virtuemart component version 3.0.14 for Joomla! Description The issue allows SQL injection by remote authenticated administrators. This can be achieved via the virtuemart paymentmethod id or virtuemart shipmentmethod id paramete...

CVE-2017-9252

andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route=search action...

CVE-2017-9252

andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route=search action...

CVE-2017-9252: Improper Neutralization of Input During Web Page Generation

andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route=search action...

asterios.tm XSS vulnerability

Vulnerable URL: https://asterios.tm/index.php?cmd=account&mod=recover Details: Description| Value ---|--- Patched:| No Latest check for patch:| 31.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 56154 VIP website status:| No Coordinated Disclosure Timeline:...

CVE-2017-9070

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...

Cross site scripting

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...

CVE-2017-9067

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...

CVE-2017-9067

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...

CVE-2017-9070

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...

PT-2017-18683

Name of the Vulnerable Software and Affected Versions MODX Revolution versions prior to 2.5.7 Description The issue arises from insufficient validation of the action parameter to the "setup/index.php" endpoint, allowing an attacker to include and execute arbitrary files on the web server due to...

CVE-2017-9070: Improper Neutralization of Input During Web Page Generation

In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...

CVE-2017-9067: Improper Limitation of a Pathname to a Restricted Directory

In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action parameter to setup/index.php, aka directory traversal...

PT-2017-18686

Name of the Vulnerable Software and Affected Versions MODX Revolution versions prior to 2.5.7 Description The issue allows a user with resource edit permissions to inject an XSS payload into the title of any post via the "connectors/index.php" endpoint, specifically through the pagetitle paramete...

srilakor.go.th XSS vulnerability

Open Bug Bounty ID: OBB-236743 Description| Value ---|--- Affected Website:| srilakor.go.th Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Catfish CMS V4.3.4 '/application/multimedia/controller/Index.php' page has an arbitrary file read vulnerability

Catfish CMS is open source PHP content management system. An arbitrary file read vulnerability exists in the Catfish CMS V4.3.4 '/application/multimedia/controller/Index.php' page. The program fails to adequately filter user input, allowing an attacker to construct a file path and read arbitrary...