CVE-2022-30352: Improper Neutralization of Special Elements used in an SQL Command

phpABook 0.9i is vulnerable to SQL Injection due to insufficient sanitization of user-supplied data in the "authuser" parameter in index.php script...

PT-2022-20072

Name of the Vulnerable Software and Affected Versions phpABook version 0.9i Description The issue arises from insufficient sanitization of user-supplied data in the auth user parameter, leading to SQL Injection. This occurs in the index.php script. Recommendations For phpABook version 0.9i,...

NukeViet Cross-Site Request Forgery (CSRF)

clearsystem.php in NukeViet 4.4 allows CSRF with resultant HTML injection via the deltype parameter to the admin/index.php?nv=webtools&op=clearsystem URI...

GHSA-J4FQ-3FM7-WH5V Magento arbitrary PHP code execution via the productData parameter

The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition CE before 1.9.2.1 and Enterprise Edition EE before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData...

Magento arbitrary PHP code execution via the productData parameter

The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition CE before 1.9.2.1 and Enterprise Edition EE before 1.14.2.1, when used with PHP before 5.4.24 or 5.5.8, allows remote authenticated users to execute arbitrary PHP code via the productData...

GHSA-G32Q-4FHF-CQ72 ImpressCMS XSS

ImpressCMS 1.3.10 has XSS via the PATHINFO to htdocs/install/index.php, htdocs/install/pagelangselect.php, or htdocs/install/pagemodcheck.php...

CVE-2022-31489: Improper Neutralization of Special Elements used in an SQL Command

Inout Blockchain AltExchanger 1.2.1 allows index.php/home/about inoutiolanguage cookie SQL injection...

PT-2022-20757

Name of the Vulnerable Software and Affected Versions Inout Blockchain AltExchanger version 1.2.1 Description The issue allows for SQL injection in the marketcurrency parameter of the "index.php/coins/update marketboxslider" API endpoint. This could potentially lead to unauthorized access or...

PT-2022-20758

Name of the Vulnerable Software and Affected Versions Inout Blockchain AltExchanger version 1.2.1 Description The issue allows for SQL injection through the inoutio language cookie in the index.php/home/about endpoint. This can potentially lead to unauthorized access or manipulation of data...

CVE-2022-31488: Improper Neutralization of Special Elements used in an SQL Command

Inout Blockchain AltExchanger 1.2.1 allows index.php/coins/updatemarketboxslider marketcurrency SQL injection...

GHSA-V3M8-7H3P-6J5M Dolibarr ERP and CRM SQLi

Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php searchsupervisor and searchstatut parameters...

Dolibarr ERP and CRM SQLi

Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php searchsupervisor and searchstatut parameters...

Cross site scripting

atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter...

CVE-2022-30776

Affected software: Atmail 6.5.0. Vulnerability: Cross-site scripting (XSS) via the index.php/admin/index/ 'error' parameter. Root cause: Improper handling/input validation of the error parameter leads to script execution in the victim’s browser. Impact (as described): attackers could execute mali...

PT-2022-20310

Name of the Vulnerable Software and Affected Versions atmail version 6.5.0 Description The issue allows for XSS via the "index.php/admin/index/" endpoint, specifically through the error parameter. Recommendations For atmail version 6.5.0, consider restricting access to the "index.php/admin/index/...

CVE-2022-30776: Improper Neutralization of Input During Web Page Generation

atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter...

GHSA-726G-CGCQ-4XW8 Dolibarr Cross-Site Scripting (XSS) vulnerability

Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting XSS vulnerabilities in versions before 5.0.4: index.php leftmenu parameter, core/ajax/box.php PATHINFO, product/stats/card.php type parameter, holiday/list.php monthcreate, monthstart, and monthend parameters, and don/card.ph...

thinkphp SQL Injection via the index.php s parameter

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

GHSA-XVHR-7Q4Q-QJGP thinkphp SQL Injection via the index.php s parameter

thinkphp 3.1.3 has SQL Injection via the index.php s parameter...

Moodle does not check for the moodle/course:viewhiddencourses capability

enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses, which allows remote attackers to obtain sensitive name and summary information about these courses by leveraging the guest role and visiting a crafted URL...