CVE-2021-39408

Cross Site Scripting XSS vulnerability exists in Online Student Rate System 1.0 via the page parameter on the index.php file...

CVE-2021-39408

The CVE-2021-39408 entry applies to Online Student Rate System v1.0. Affected: index.php page parameter handling in the application. Root cause: lack of input validation/escaping of user-supplied data in the page parameter leading to Cross-Site Scripting (XSS). Impact: attacker could cause client...

CVE-2022-30117

Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changin...

CVE-2021-39408: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability exists in Online Student Rate System 1.0 via the page parameter on the index.php file...

PT-2022-20008

Name of the Vulnerable Software and Affected Versions Concrete versions 8.5.7 and below Concrete versions 9.0 through 9.0.2 Description The issue allows traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing...

PT-2022-10910

Name of the Vulnerable Software and Affected Versions Online Student Rate System version 1.0 Description A Cross Site Scripting XSS issue exists via the page parameter on the "index.php" file. This allows for potential malicious script execution. Recommendations For Online Student Rate System...

CVE-2022-30117: Improper Limitation of a Pathname to a Restricted Directory

Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changin...

Online Student Rate System Cross-site Script Vulnerability

Online Student Rate System is an online grading system for students. v1.0 of the Online Student Rate System is vulnerable to a cross-site scripting vulnerability that stems from a lack of validation filtering of user-supplied data and output data in the page parameter of the index.php file. An...

Cross site scripting

PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=authorsee request to index.php...

Cross-site Scripting (XSS)

microweber/microweber is vulnerable to cross-site scriptingXSS attacks. A remote attacker is able to inject and execute malicious javascript via bypassing XSS filters in index.php, resulting in cookie stealing and account takeover...

CVE-2022-34328: Improper Neutralization of Input During Web Page Generation

PMB 7.3.10 allows reflected XSS via the id parameter in an lvl=authorsee request to index.php...

CVE-2022-31062: Improper Limitation of a Pathname to a Restricted Directory

Impact A plugin public script can be used to read content of system files. Patches Upgrade to version 1.0.2. Workarounds b/deploy/index.php file can be deleted if deploy feature is not used...

CVE-2022-31062

Impact A plugin public script can be used to read content of system files. Patches Upgrade to version 1.0.2. Workarounds "b/deploy/index.php" file can be deleted if deploy feature is not used...

CVE-2022-31355: Improper Neutralization of Special Elements used in an SQL Command

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/index.php?q=category&search=...

PT-2022-20711

Name of the Vulnerable Software and Affected Versions Online Ordering System version 2.3.2 Description The issue is related to a SQL injection vulnerability. It can be exploited via the "/ordering/index.php?q=category&search=" API endpoint. The search parameter is vulnerable. Recommendations For...

PT-2022-20712

Name of the Vulnerable Software and Affected Versions Online Ordering System version 2.3.2 Description The issue is related to a SQL injection vulnerability. It can be exploited via the "/ordering/admin/store/index.php?view=edit&id=" API endpoint, specifically through the id variable. This...

CVE-2022-31357: Improper Neutralization of Special Elements used in an SQL Command

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=...

CVE-2021-41654

SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php...

CVE-2021-41654

SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php...

CVE-2021-41654: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php...