CVE-2024-56361 Stored Cross-Site Scripting (XSS) in lgsl v7.0

LGSL Live Game Server List provides online status for games. Before 7.0.0, a stored cross-site scripting XSS vulnerability was identified in lgsl. The function lgslquery40 in lgslprotocol.php has implemented an HTTP crawler. This function makes a request to the registered game server, and upon...

lgsl Stored Cross-Site Scripting vulnerability

Summary A stored cross-site scripting XSS vulnerability was identified in lgsl. The issue arises from improper sanitation of user input. Everyone who accesses this page will be affected by this attack. Details The function lgslquery40 in lgslprotocol.php has implemented an HTTP crawler. This...

CVE-2024-46547

A vulnerability was found in Romain Bourdon Wampserver all versions discovered in v3.2.3 and v3.2.6 where unauthorized users could access sensitive information due to improper access control validation via PHP Info Page. This issue can lead to data leaks...

CVE-2024-46547

CVE-2024-46547 affects Wampserver (Romain Bourdon) versions 3.2.3 and 3.2.6. The issue arises from improper access-control validation on the PHP Info Page, allowing unauthorized users to access sensitive information. The documented impact is data leakage. No remediation details are provided in th...

TONGDA Office Anywhere SQL注入漏洞

TONGDA Office Anywhere is a collaborative office OA system of China Tongda TONGDA. TONGDA Office Anywhere has a SQL injection vulnerability that originates from the RUNID parameter of the /pda/approvecenter/prcsinfo.php page that contains a SQL injection vulnerability...

CVE-2024-9952

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/?page=systeminfo/contactinfo of the component Contact Information Page. The manipulation of the argument Address leads to cross site...

SourceCodester Online Eyewear Shop 跨站脚本漏洞

SourceCodester Online Eyewear Shop is a SourceCodester open source online eyewear store website project developed using PHP and MySQL, which provides an online shopping and ordering platform for the eyewear business and its potential customers. A cross-site scripting vulnerability exists in...

PT-2024-37940 · Unknown · Sourcecodester Record Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Record Management System version 1.0 Description: A critical issue has been discovered, affecting the file view info.php. The manipulation of the id argument leads to SQL injection. This issue can be exploited remotely...

The vulnerability of the System Info Page component of the Data Management System’s SourceCodester Service Provider Management System allows a attacker to perform XSS attacks.

The vulnerability of the System Info Page component of the Data Management System SourceCodester Service Provider Management System exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...

Insertion Of Sensitive Information Into Sent Data

github.com/pomerium/pomerium is vulnerable to Insertion of Sensitive Information Into Sent Data. The vulnerability is due to the inclusion of serialized OAuth2 access and ID tokens from the logged-in user's session in the user info page /.pomerium...

CVE-2024-39315 Pomerium exposed OAuth2 access and ID tokens in user info endpoint response

Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page at /.pomerium unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users. This issue may be...

CVE-2024-6267 SourceCodester Service Provider Management System System Info Page index.php cross site scripting

A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown functionality of the file systeminfo/index.php of the component System Info Page. The manipulation of the argument System Name/System Short Na...

CVE-2024-6267 SourceCodester Service Provider Management System System Info Page index.php cross site scripting

A vulnerability classified as problematic was found in SourceCodester Service Provider Management System 1.0. Affected by this vulnerability is an unknown functionality of the file systeminfo/index.php of the component System Info Page. The manipulation of the argument System Name/System Short Na...

CVE-2024-6267

CVE-2024-6267 affects SourceCodester Service Provider Management System 1.0. The vulnerability is in the System Info Page (system_info/index.php) and arises from improper handling of the System Name/System Short Name, enabling cross-site scripting. The issue is exploitable remotely and the exploi...

PT-2024-4568 · Sourcecodester · Sourcecodester Service Provider Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Service Provider Management System version 1.0 Description: A vulnerability was found in the System Info Page component of the SourceCodester Service Provider Management System. The issue is due to the lack of protection measur...

CVE-2024-37803

Multiple stored cross-site scripting XSS vulnerabilities in CodeProjects Health Care hospital Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname and lname parameters under the Staff Info page...

Netgear R6850 安全漏洞

The NETGEAR Netgear R6850 is a wireless router from NETGEAR. A security vulnerability exists in Netgear R6850 version v1.1.0.88, which originates from an information disclosure vulnerability in debuginfo.htm. The vulnerability can be exploited by an attacker to obtain sensitive information...

Teacher Subject Allocation Management System teacher-info.php File SQL Injection Vulnerability

Teacher Subject Allocation Management System a teacher subject allocation management system. The Teacher Subject Allocation Management System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the editid parameter of...

CVE-2023-45015

Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'date' parameter of the businfo.php resource does not validate the characters received and they are sent unfiltered to the database...

Online Bus Booking System SQL Injection Vulnerability

Online Bus Booking System is an online bus booking system. A SQL injection vulnerability exists in Online Bus Booking System v1.0, which is caused by insufficient filtering of the useremail parameter on the businfo.php page, resulting in a SQL injection vulnerability...