CVE-2024-37791

DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/index?classid...

CVE-2024-37791

DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/index?classid...

PT-2024-27753 · Duxcms3 · Duxcms3

Name of the Vulnerable Software and Affected Versions: DuxCMS3 version 3.1.3 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the keyword parameter at the "/article/Content/index?class id" API endpoint. Recommendations: For DuxCMS3 versio...

CVE-2024-37791

DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/index?classid...

CVE-2024-37791

DuxCMS3.1.3 is vulnerable to SQL injection via the keyword parameter in /article/Content/index?class_id. The connected exploit details show time-based blind injection using LIKE and unfiltered $value, with payloads that retrieve database name and can delay execution (sleep(1/3)) to confirm exploi...

DuxCMS SQL Injection Vulnerability

DuxCMS is an open source content management system. A SQL injection vulnerability exists in DuxCMS version v3.1.3, which originates from the keyword parameter in /article/Content/index?classid contains a SQL injection vulnerability...

CVE-2024-37791

DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/index?classid...

PT-2024-20982 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the txt keyword parameter at the "get company.aspx" endpoint. Recommendations: For versions 6.01...

RuvarOA 安全漏洞

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which is caused by the lack of validation of the txtkeyword parameter of the getcompany.aspx file against externally entered SQL statements. An attacker can exploit this...

PT-2024-19538 · Unknown · Form Tools

Name of the Vulnerable Software and Affected Versions: Form Tools version 3.1.1 Description: The issue allows attackers to run arbitrary SQL commands via the keyword when searching for a client. This can be exploited by manipulating the search functionality. Recommendations: For Form Tools versio...

Ecommerce-Website SQL Injection Vulnerability

Ecommerce-Website is a complete e-commerce website with an administration panel built using PHP and MySql. A SQL injection vulnerability exists in Ecommerce-Website version 1.0, which stems from the parameter catid/brandid/keyword in the file action.php that can lead to SQL injection...

CVE-2024-22490

Cross Site Scripting XSS vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the /index keyword parameter...

PT-2024-19447 · Beetl-Bbs · Beetl-Bbs

Name of the Vulnerable Software and Affected Versions: beetl-bbs version 2.0 Description: The issue is related to a Cross Site Scripting XSS flaw that allows attackers to execute arbitrary code. This is achieved by exploiting the keyword parameter in the "/index" API endpoint. Recommendations: Fo...

CVE-2024-22490

Cross Site Scripting XSS vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the /index keyword parameter...

CVE-2024-0481

A vulnerability was found in Taokeyun up to 1.0.5. It has been rated as critical. Affected by this issue is the function shopGoods of the file application/index/controller/app/store/Goods.php of the component HTTP POST Request Handler. The manipulation of the argument keyword leads to sql...

Taokeyun SQL Injection Vulnerability

Taokeyun is a shopping mall system by jifeer personal developer. A SQL injection vulnerability exists in Taokeyun version 1.0.5 and earlier versions, which originates from a SQL injection vulnerability in the keyword parameter of the shopGoods function in the...

CVE-2023-7124

A vulnerability, which was classified as problematic, was found in code-projects E-Commerce Site 1.0. Affected is an unknown function of the file search.php. The manipulation of the argument keyword with the input leads to cross site scripting. It is possible to launch the attack remotely. The...

affiliate-toolkit – WordPress Affiliate Plugin < 3.4.4 - Reflected Cross-Site Scripting via keyword

Description The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the keyword parameter in versions up to, and including, 3.4.3 due to insufficient input sanitization and output escaping. This makes it possible for...

EventPrime < 3.2.0 - Reflected XSS

Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. POC 1 - Visit any of the following pages created by the plugin: - Event Organize...

EventPrime < 3.2.0 - Reflected HTML Injection on keyword parameter

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on the plugin in the search area of the website. Insert '"Clickme! on the keyword search field or directly on the link...