13451 matches found
CVE-2022-37190
CuppaCMS 1.0 is vulnerable to Remote Code Execution RCE. An authenticated user can control both parameters action and function from "/api/index.php...
CVE-2022-37191: Inclusion of Functionality from Untrusted Control Sphere
The component "cuppa/api/index.php" of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using function parameter value as LFI payload...
Cross site scripting
Multiple persistent cross-site scripting XSS vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers to inject arbitrary web script or HTML via multiple parameters such as "fullname"...
CVE-2022-36254
The connected PT-2022-23273 entry provides concrete details for CVE-2022-36254: tramyardg Hotel Management System 1.0 (index.php) is vulnerable to persistent XSS via the fullname parameter, enabling remote script/HTML injection. Affected component is index.php; root cause is improper handling of ...
CVE-2022-36254: Improper Neutralization of Input During Web Page Generation
Multiple persistent cross-site scripting XSS vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers to inject arbitrary web script or HTML via multiple parameters such as "fullname"...
CVE-2022-38267: Improper Neutralization of Special Elements used in an SQL Command
School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/user/index.php?view=edit&id=...
CVE-2022-38268: Improper Neutralization of Special Elements used in an SQL Command
School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/autonumber/index.php?view=edit&id=...
CVE-2022-38269: Improper Neutralization of Special Elements used in an SQL Command
School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/modstudent/index.php?view=edit&id=...
CVE-2022-3120: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in SourceCodester Clinics Patient Management System. Affected by this vulnerability is an unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. The attack can be launch...
Cross site scripting
PicUploader v2.6.3 was discovered to contain a cross-site scripting XSS vulnerability via the component /master/index.php...
CVE-2022-36748
CVE-2022-36748 affects PicUploader v2.6.3, with a Cross-Site Scripting (XSS) vulnerability exposed through the /master/index.php component. The NVD entry documents the vulnerability as an XSS with a network attack vector, requiring user interaction, and reports low impact on confidentiality and i...
CVE-2022-36748
PicUploader v2.6.3 was discovered to contain a cross-site scripting XSS vulnerability via the component /master/index.php...
CVE-2022-36748
PicUploader v2.6.3 was discovered to contain a cross-site scripting XSS vulnerability via the component /master/index.php...
CVE-2022-36748: Improper Neutralization of Input During Web Page Generation
PicUploader v2.6.3 was discovered to contain a cross-site scripting XSS vulnerability via the component /master/index.php...
CVE-2022-3012
A vulnerability was found in oretnom23 Fast Food Ordering System. It has been rated as critical. Affected by this issue is some unknown functionality of the file ffos/admin/reports/index.php. The manipulation of the argument date leads to sql injection. The attack may be launched remotely. The...
PT-2022-20011
Name of the Vulnerable Software and Affected Versions oretnom23 Fast Food Ordering System affected versions not specified Description A critical issue was found in the oretnom23 Fast Food Ordering System, affecting some unknown functionality of the file ffos/admin/reports/index.php. The...
CVE-2022-3012: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in oretnom23 Fast Food Ordering System. It has been rated as critical. Affected by this issue is some unknown functionality of the file ffos/admin/reports/index.php. The manipulation of the argument date leads to sql injection. The attack may be launched remotely. The...
CVE-2022-36547
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a reflected cross-site scripting XSS vulnerability at /patient/index.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search field...
CVE-2022-36547: Improper Neutralization of Input During Web Page Generation
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a reflected cross-site scripting XSS vulnerability at /patient/index.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search field...