13451 matches found
PT-2022-10910
Name of the Vulnerable Software and Affected Versions Online Student Rate System version 1.0 Description A Cross Site Scripting XSS issue exists via the page parameter on the "index.php" file. This allows for potential malicious script execution. Recommendations For Online Student Rate System...
CVE-2022-30117: Improper Limitation of a Pathname to a Restricted Directory
Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changin...
Cross site scripting
PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=authorsee request to index.php...
Cross-site Scripting (XSS)
microweber/microweber is vulnerable to cross-site scriptingXSS attacks. A remote attacker is able to inject and execute malicious javascript via bypassing XSS filters in index.php, resulting in cookie stealing and account takeover...
CVE-2022-34328: Improper Neutralization of Input During Web Page Generation
PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=authorsee request to index.php...
CVE-2022-31062
Impact A plugin public script can be used to read content of system files. Patches Upgrade to version 1.0.2. Workarounds "b/deploy/index.php" file can be deleted if deploy feature is not used...
CVE-2022-31062: Improper Limitation of a Pathname to a Restricted Directory
Impact A plugin public script can be used to read content of system files. Patches Upgrade to version 1.0.2. Workarounds b/deploy/index.php file can be deleted if deploy feature is not used...
PT-2022-20712
Name of the Vulnerable Software and Affected Versions Online Ordering System version 2.3.2 Description The issue is related to a SQL injection vulnerability. It can be exploited via the "/ordering/admin/store/index.php?view=edit&id=" API endpoint, specifically through the id variable. This...
CVE-2022-31357: Improper Neutralization of Special Elements used in an SQL Command
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=...
PT-2022-20711
Name of the Vulnerable Software and Affected Versions Online Ordering System version 2.3.2 Description The issue is related to a SQL injection vulnerability. It can be exploited via the "/ordering/index.php?q=category&search=" API endpoint. The search parameter is vulnerable. Recommendations For...
CVE-2022-31355: Improper Neutralization of Special Elements used in an SQL Command
Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/index.php?q=category&search=...
CVE-2021-41654
SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php...
CVE-2021-41654
SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php...
CVE-2021-41654: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php...
PT-2022-11453
Name of the Vulnerable Software and Affected Versions Wuzhicms version 4.1.0 Description The issue allows attackers to execute arbitrary SQL commands via the keyValue parameter in the "/coreframe/app/pay/admin/index.php" API endpoint. This enables attackers to manipulate database queries,...
dynamicMarkt SQL Injection Vulnerability (CNVD-2022-67151)
dynamicMarkt is a software. dynamicMarkt 3.10 and earlier versions are vulnerable to SQL injection, which stems from a missing filter escape for SQL data in the parent parameter of index,php. An attacker could use this vulnerability to execute illegal SQL commands to steal sensitive database data...
dynamicMarkt SQL Injection Vulnerability (CNVD-2022-67152)
dynamicMarkt is a software. dynamicMarkt 3.10 and earlier versions are vulnerable to SQL injection, which stems from a problem with the kat parameter in index.php and can be exploited by attackers for SQL injection...
PT-2022-11474
Name of the Vulnerable Software and Affected Versions SEOmatic plugin version 3.4.10 for Craft CMS 3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script via a GET to "/index.php?action=seomatic/file/seo-file-link" with url parameter containing the...
