13671 matches found
CVE-2024-33963: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in PayPal, Credit Card and Debit Card Payment affecting version 1.0. An attacker could exploit this vulnerability by sending a specially crafted query to the server and retrieve all the information stored in it through the following 'id' in '/admin/modroom/index.php'...
PT-2024-25610
Name of the Vulnerable Software and Affected Versions E-Negosyo System version 1.0 Description The issue is related to a Cross-Site Scripting XSS vulnerability. An attacker could create a specially crafted URL and send it to a victim to obtain their session cookie details via the category paramet...
PT-2024-25617
Name of the Vulnerable Software and Affected Versions School Attendance Monitoring System and School Event Management System version 1.0 Description A Cross-Site Scripting XSS issue exists, allowing an attacker to create a specially crafted URL and send it to a victim. This could lead to the...
PT-2024-25618
Name of the Vulnerable Software and Affected Versions School Attendance Monitoring System and School Event Management System version 1.0 Description A Cross-Site Scripting XSS issue exists, allowing an attacker to create a specially crafted URL and send it to a victim. This could lead to the...
CVE-2024-7438 SimpleMachines SMF User Alert Read Status index.php resource injection
A vulnerability has been found in SimpleMachines SMF 2.1.4 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php?action=profile;u=2;area=showalerts;do=read of the component User Alert Read Status Handler. The manipulation of the argument...
CVE-2024-7437 SimpleMachines SMF Delete User index.php resource injection
A vulnerability, which was classified as critical, was found in SimpleMachines SMF 2.1.4. Affected is an unknown function of the file /index.php?action=profile;u=2;area=showalerts;do=remove of the component Delete User Handler. The manipulation of the argument aid leads to improper control of...
CVE-2024-7437 SimpleMachines SMF Delete User index.php resource injection
A vulnerability, which was classified as critical, was found in SimpleMachines SMF 2.1.4. Affected is an unknown function of the file /index.php?action=profile;u=2;area=showalerts;do=remove of the component Delete User Handler. The manipulation of the argument aid leads to improper control of...
CVE-2024-7320 itsourcecode Online Blood Bank Management System Admin Login index.php sql injection
A vulnerability classified as critical has been found in itsourcecode Online Blood Bank Management System 1.0. This affects an unknown part of the file /admin/index.php of the component Admin Login. The manipulation of the argument user leads to sql injection. It is possible to initiate the attac...
CVE-2024-7320: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in itsourcecode Online Blood Bank Management System 1.0. This affects an unknown part of the file /admin/index.php of the component Admin Login. The manipulation of the argument user leads to sql injection. It is possible to initiate the attac...
PT-2024-38265
Name of the Vulnerable Software and Affected Versions itsourcecode Online Blood Bank Management System version 1.0 Description A critical vulnerability has been found in the itsourcecode Online Blood Bank Management System. This issue affects the /admin/index.php file of the Admin Login component...
CVE-2024-7281: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in SourceCodester Lot Reservation Management System 1.0. Affected is an unknown function of the file /admin/index.php?page=managelot. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The...
CVE-2024-40576
The Best House Rental Management System version 1.0 is vulnerable to a Cross-Site Scripting (XSS) flaw. A remote attacker can execute arbitrary code by manipulating the "House No" and "Description" parameters within the houses page of the index.php component. This is caused by improper neutraliza...
CVE-2024-40576
Cross Site Scripting vulnerability in Best House Rental Management System 1.0 allows a remote attacker to execute arbitrary code via the "House No" and "Description" parameters in the houses page at the index.php component...
CVE-2024-37859: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the page parameter to php-lfis/admin/index.php...
CVE-2024-40576: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Best House Rental Management System 1.0 allows a remote attacker to execute arbitrary code via the "House No" and "Description" parameters in the houses page at the index.php component...
CVE-2024-7163 SeaCMS index.php cross site scripting
A vulnerability, which was classified as problematic, was found in SeaCMS 12.9. This affects an unknown part of the file /js/player/dmplayer/player/index.php. The manipulation of the argument color/vid/url leads to cross site scripting. It is possible to initiate the attack remotely. The exploit...
CVE-2024-7163
A vulnerability, which was classified as problematic, was found in SeaCMS 12.9. This affects an unknown part of the file /js/player/dmplayer/player/index.php. The manipulation of the argument color/vid/url leads to cross site scripting. It is possible to initiate the attack remotely. The exploit...
CVE-2024-7163: Improper Neutralization of Input During Web Page Generation
A vulnerability, which was classified as problematic, was found in SeaCMS 12.9. This affects an unknown part of the file /js/player/dmplayer/player/index.php. The manipulation of the argument color/vid/url leads to cross site scripting. It is possible to initiate the attack remotely. The exploit...
CVE-2024-6573: Exposure of Sensitive Information to an Unauthorized Actor
The Intelligence plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.4.0. This is due the plugin not preventing direct access to the /vendor/levelten/intel/realtime/index.php file and displayerrors being enabled. This makes it possible for...
