CVE-2022-40447

ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the keyword parameter at /admin/baojialist.php...

Sql injection

ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the keyword parameter at /admin/baojialist.php...

CVE-2022-40447

ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the keyword parameter at /admin/baojialist.php...

CVE-2022-40447

CVE-2022-40447 affects ZZCMS 2022 with a SQL injection in the admin/baojia_list.php endpoint through the keyword parameter. The vulnerability is described as an SQL injection (concrete vulnerable vector: keyword parameter) and is rated with CVSS 3.1: 7.2 (HIGH) with network attack vector, low att...

PT-2022-25390 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2022 Description: The issue is related to a SQL injection vulnerability. It occurs via the keyword parameter at the "/admin/baojia list.php" API endpoint. Recommendations: For ZZCMS version 2022, avoid using the keyword paramete...

CVE-2022-3242 HTML code Injection in template search keyword in microweber/microweber

Code Injection in GitHub repository microweber/microweber prior to 1.3.2...

CVE-2022-1580

The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature...

CVE-2022-36085

A flaw was found in open-policy-agent. The Rego compiler provides a deprecated WithUnsafeBuiltins function, allowing users to provide a set of built-in functions that should be deemed unsafe and rejected by the compiler if encountered in the policy compilation stage. A bypass of this protection c...

Open Policy Agent 安全漏洞

Open Policy Agent is an open source, general-purpose policy engine that enables uniform, context-aware policy enforcement across the stack. A security vulnerability exists in Open Policy Agent OPA that stems from the use of the with keyword to bypass WithUnsafeBuiltins to emulate functions...

CVE-2022-2541

The uContext for Amazon plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 3.9.1. This is due to missing nonce validation in the /app/sites/ajax/actions/keywordsave.php file that is called via the doAjax function. This makes i...

CVE-2022-2542

The uContext for Clickbank plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 3.9.1. This is due to missing nonce validation in the /app/sites/ajax/actions/keywordsave.php file that is called via the doAjax function. This make...

PT-2022-17273

Name of the Vulnerable Software and Affected Versions uContext for Amazon plugin for WordPress versions up to, and including 3.9.1 Description The issue is related to Cross-Site Request Forgery to Cross-Site Scripting due to missing nonce validation in the /app/sites/ajax/actions/keyword save.php...

gomatrixserverlib 安全漏洞

gomatrixserverlib is a Go library open-sourced by matrix.org. Used for common functions required by the matrix server. A security vulnerability exists in gomatrixserverlib, which stems from the inability of its power level parsing program to parse the "eventsdefault" keyword of the...

CVE-2022-35121

Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...

CVE-2022-35121

Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...

CVE-2022-35121

CVE-2022-35121 affects Novel-Plus v3.6.1 with a SQL injection via the keyword parameter on the endpoint /service/impl/BookServiceImpl.java. The NVD entry lists a CVSS v3.1 base score of 9.8 (CRITICAL) with network attack vector, no privileges required, and user interaction not needed; impact is H...

CVE-2022-35121

Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java...

novel-plus SQL注入漏洞

novel-plus novel-plus is a multi-end PC, WAP reading, full-featured original literature CMS system. A security vulnerability exists in novel-plus v3.6.1, which is caused by an SQL injection vulnerability in the keyword parameter /service/impl/BookServiceImpl.java...

PT-2022-22587 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus version 3.6.1 Description: The issue is related to a SQL injection vulnerability. It occurs via the keyword parameter at the /service/impl/BookServiceImpl.java endpoint. Recommendations: For Novel-Plus version 3.6.1, consider...

Cross-site Scripting (XSS)

com.jfinal:jfinal is vulnerable to cross-site scriptingXSS attacks. A remote attacker is able to inject and execute arbitrary javascript via a crafted payload injected into the keyword text field under the publish blog module...