485 matches found
CVE-2023-51504
CVE-2023-51504 هذا هو إعادة إنتاج مُحَوْل إلى Docker لحقن SQL في MotoCMS راجع قاعدة بيانات الاستغلال الوصف حقن SQL في MotoCMS الإصدار 3.4.3 عبر معلمة الكلمة المفتاحية على الرابط https://template189526.motopreview.com/store/category/search/?keyword=1 تضمن إعادة إنتاج الثغرة تعريف في ملف Dockerfile...
CVE-2024-37791
CVE-2024-37791 CVE-2024-37791 رابط المشروع: الأعمال التحضيرية: سجّل الدخول إلى الخلفية - احصل على الكوكيز. رابط الثغرة: http://127.0.0.1:8093/s/article/Content/index?classid=&keyword= معامل الثغرة: keyword الحمولة payload: %27andselectfromselect+ifasciisubstrdatabase,1,1%3E97,sleep1,0a//union/...
CVE-2025-51970
CVE-2025-51970 CVE-2025-51970 - حقن SQL في نظام التسوق عبر الإنترنت المتقدم ملخص تم اكتشاف ثغرة أمنية خطيرة من نوع حقن SQL في مشروع Online Shopping System Advanced بواسطة PuneethReddyHC. توجد الثغرة في action.php، الذي يفشل في تنقية إدخال المستخدم من معامل POST keyword بشكل صحيح. يمكن للمهاجم حقن...
WordPress Pochipp plugin <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter vulnerability
Reflected Cross-Site Scripting via 'keyword' Parameter vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Pochipp versions = 1.20.2...
CVE-2026-92967
The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insufficient output escaping , which reads $GET'keyword', applies only sanitizetextfield which strips tags but leaves double quotes...
CVE-2026-92967 Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter
The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insufficient output escaping , which reads $GET'keyword', applies only sanitizetextfield which strips tags but leaves double quotes...
EUVD-2026-83479
The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insufficient output escaping , which reads $GET'keyword', applies only sanitizetextfield which strips tags but leaves double quotes...
PT-2026-95748
Name of the Vulnerable Software and Affected Versions Pochipp versions prior to 1.20.3 Description The plugin is subject to Reflected Cross-Site Scripting, a flaw where an application includes untrusted data in a web page without proper validation or escaping. This occurs because the application...
CVE-2026-92967: Improper Neutralization of Input During Web Page Generation
The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insufficient output escaping , which reads $GET'keyword', applies only sanitizetextfield which strips tags but leaves double quotes...
PT-2026-90594
Name of the Vulnerable Software and Affected Versions Royal Addons for Elementor – Addons and Templates Kit for Elementor versions prior to 1.7.107 Description The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress allows unauthenticated attackers to extract...
CVE-2026-82701 code-projects Online Shopping System Search Functionality action.php sql injection
A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...
EUVD-2026-68594
A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...
CVE-2026-46686 Emlog Reflected Cross-Site Scripting
Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected...
CVE-2026-46686: Improper Neutralization of Input During Web Page Generation
Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected...
CVE-2026-12385
The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via the 'keyword' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract titles and full content...
CVE-2026-12385
The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via the 'keyword' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract titles and full content...
CVE-2026-12385 Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter
The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via the 'keyword' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract titles and full content...
CVE-2026-12385 Smart Slider 3 <= 3.5.1.37 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via WP_Query Parameter Injection via 'keyword' Parameter
The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via the 'keyword' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract titles and full content...
CVE-2026-12385
CVE-2026-12385 affects the Smart Slider 3 WordPress plugin up to version 3.5.1.37. The issue is a Sensitive Information Exposure via the keyword parameter, enabling authenticated attackers with contributor-level access and above to extract titles and full content excerpts from private, draft, pen...
CVE-2026-12385: Exposure of Sensitive Information to an Unauthorized Actor
The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via the 'keyword' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract titles and full content...