PT-2018-15003

Name of the Vulnerable Software and Affected Versions arcms through 2018-03-19 Description An issue exists in the software due to SQL injection via the limit parameter in the json/newslist endpoint. This is caused by files ctl/main/Json.php, ctl/main/service/Data.php, and comp/Db/Mysql.php...

CVE-2018-19558: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in arcms through 2018-03-19. SQL injection exists via the json/newslist limit parameter because of ctl/main/Json.php, ctl/main/service/Data.php, and comp/Db/Mysql.php...

PT-2018-14739

Name of the Vulnerable Software and Affected Versions KindEditor versions prior to 4.1.12 Description The issue allows unauthorized access to files or directories within the kindeditor/attached/ folder via the path parameter in php/upload json.php, without requiring authentication. Recommendation...

XML External Entity (XXE) Processing

zendframework/zend-json is susceptible to XML external entity XXE processing attacks. The attacks can be triggered because when loading an XML formatted string into a Simple XML Element object. The fromXml function in Json.php does not validate the XML formatted string properly...

PT-2017-11013

Name of the Vulnerable Software and Affected Versions Kind Editor version 4.1.12 Description The issue concerns a lack of authentication check in the file upload functionality. Specifically, the kindeditor/php/upload json.php endpoint does not verify user authentication before allowing file...

lottery.kapook.com XSS vulnerability

Vulnerable URL: http://lottery.kapook.com/json.php?jsonp=1=prompt/OPENBUGBOUNTY/...

iu.edu XSS vulnerability

Open Bug Bounty ID: OBB-58010 Description| Value ---|--- Affected Website:| iu.edu Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat Sheet...

CVE-2014-8352

Cross-site scripting XSS vulnerability in json.php in French National Commission on Informatics and Liberty aka CNIL CookieViz allows remote we servers to inject arbitrary web script or HTML via the maxdate parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in json.php in French National Commission on Informatics and Liberty aka CNIL CookieViz allows remote we servers to inject arbitrary web script or HTML via the maxdate parameter...

CVE-2014-8352

CVE-2014-8352 affects CNIL CookieViz: the json.php endpoint is vulnerable to cross-site scripting via the max_date parameter, allowing remote injection of arbitrary script/HTML. The NVD entry lists a MEDIUM base score (CVSS2: AV:N/AC:M/Au:N/C:N/I:P/A:N; base 4.3) with partial integrity impact and...

CVE-2014-8352

Cross-site scripting XSS vulnerability in json.php in French National Commission on Informatics and Liberty aka CNIL CookieViz allows remote we servers to inject arbitrary web script or HTML via the maxdate parameter...

PT-2014-8484

Name of the Vulnerable Software and Affected Versions CookieViz affected versions not specified Description A cross-site scripting XSS issue exists, allowing remote web servers to inject arbitrary web script or HTML via the max date parameter in the json.php file. Recommendations As a temporary...

CVE-2014-8352: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in json.php in French National Commission on Informatics and Liberty aka CNIL CookieViz allows remote we servers to inject arbitrary web script or HTML via the maxdate parameter...

PT-2014-2278

Name of the Vulnerable Software and Affected Versions Group-Office community versions prior to 4.0.90 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the sort parameter in the modules/calendar/json.php file. Recommendations For...

CVE-2012-4240: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter...

TomatoCart - json.php Security Bypass

TomatoCart - json.php Security Bypass source: https://www.securityfocus.com/bid/57156/info TomatoCart is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and create files with arbitrary shell script which may aid in further...

TomatoCart 'json.php' Directory Traversal Vulnerability

TomatoCart is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Directory traversal

Directory traversal vulnerability in json.php in TomatoCart 1.2.0 Alpha 2 and possibly earlier allows remote attackers to read arbitrary files via a .. dot dot in the module parameter in a "3" action...

CVE-2012-5907

CVE-2012-5907 corresponds to a directory traversal vulnerability in TomatoCart's json.php (TomatoCart 1.2.0 Alpha 2 and possibly earlier). The issue allows remote attackers to read arbitrary files by injecting a .. in the module parameter for a "3" action, effectively a Local File Inclusion (LFI)...

CVE-2012-5907: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in json.php in TomatoCart 1.2.0 Alpha 2 and possibly earlier allows remote attackers to read arbitrary files via a .. dot dot in the module parameter in a "3" action...