485 matches found
CVE-2026-1931 Rent Fetch <= 0.32.4 - Unauthenticated Stored Cross-Site Scripting via 'keyword' Parameter
The Rent Fetch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'keyword' parameter in all versions up to, and including, 0.32.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for unauthenticated attackers to...
CVE-2026-1931 Rent Fetch <= 0.32.4 - Unauthenticated Stored Cross-Site Scripting via 'keyword' Parameter
The Rent Fetch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'keyword' parameter in all versions up to, and including, 0.32.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for unauthenticated attackers to...
CVE-2026-1931: Improper Neutralization of Input During Web Page Generation
The Rent Fetch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'keyword' parameter in all versions up to, and including, 0.32.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for unauthenticated attackers to...
PT-2026-20292
Name of the Vulnerable Software and Affected Versions Rent Fetch plugin for WordPress versions up to and including 0.32.4 Description The Rent Fetch plugin for WordPress is susceptible to Stored Cross-Site Scripting through the keyword parameter. This is due to inadequate input sanitization and...
PT-2026-5957
Name of the Vulnerable Software and Affected Versions TOTOLINK A950RG version 4.1.2cu.5204 B20210112 Description A buffer overflow issue exists in the setParentalRules interface. The urlKeyword parameter does not undergo proper validation. The system concatenates multiple user-supplied values int...
CVE-2025-67189
The TOTOLINK A950RG (version 4.1.2cu.5204_B20210112 ) is vulnerable to a buffer overflow in the setParentalRules interface. The root cause is insufficient validation of the urlKeyword parameter, where the system concatenates multiple user-controlled fields into a fixed-size stack buffer without p...
JeecgBoot SQL注入漏洞
JeecgBoot is a Java low-code platform developed by Jeecg Corporation, designed for enterprise web applications. Version 3.9.0 of JeecgBoot contains a SQL injection vulnerability. This vulnerability arises from incorrect handling of the parameter “keyword” in the file...
CVE-2021-47856
Easy Cart Shopping Cart 2021 contains a non-persistent cross-site scripting vulnerability in the search module's keyword parameter. Remote attackers can inject malicious script code through the search input to compromise user sessions and manipulate application content...
CVE-2021-47856: Improper Neutralization of Input During Web Page Generation
Easy Cart Shopping Cart 2021 contains a non-persistent cross-site scripting vulnerability in the search module's keyword parameter. Remote attackers can inject malicious script code through the search input to compromise user sessions and manipulate application content...
CVE-2025-41005
Imaster's MEMS Events CRM contains an SQL injection vulnerability in‘keyword’ parameter in ‘/memsdemo/exchangeoffers.php’...
CVE-2025-41005
Imaster's MEMS Events CRM contains an SQL injection vulnerability in‘keyword’ parameter in ‘/memsdemo/exchangeoffers.php’...
CVE-2025-41005 Multiple vulnerabilities in Imaster products Open configuration options
Imaster's MEMS Events CRM contains an SQL injection vulnerability in‘keyword’ parameter in ‘/memsdemo/exchangeoffers.php’...
CVE-2025-41005
CVE-2025-41005 affects Imaster’s MEMS Events CRM. The vulnerability is an SQL injection in the keyword parameter of the /memsdemo/exchange_offers.php endpoint, caused by unsafeguarded input handling in that API. Impact is high (potential for unauthorized data access/modification);CVSS v4.0 base s...
CVE-2025-41005 Multiple vulnerabilities in Imaster products Open configuration options
Imaster's MEMS Events CRM contains an SQL injection vulnerability in‘keyword’ parameter in ‘/memsdemo/exchangeoffers.php’...
EUVD-2026-1933
Imaster's MEMS Events CRM contains an SQL injection vulnerability in‘keyword’ parameter in ‘/memsdemo/exchangeoffers.php’...
MEMS - Events CRM SQL注入漏洞
MEMS - Events CRM is a Customer Relationship Management system by the individual developer Nzioka Victor. MEMS - Events CRM suffers from a SQL injection vulnerability that originates in the keyword parameter in /memsdemo/exchangeoffers.php...
PT-2026-2264
Name of the Vulnerable Software and Affected Versions Imaster's MEMS Events CRM affected versions not specified Description The software contains an SQL injection issue in the keyword parameter of the '/memsdemo/exchange offers.php' API endpoint. This allows for potential unauthorized database...
CVE-2025-41005: Improper Neutralization of Special Elements used in an SQL Command
Imaster's MEMS Events CRM contains an SQL injection vulnerability in‘keyword’ parameter in ‘/memsdemo/exchangeoffers.php’...
CVE-2009-4316
Cross-site scripting XSS vulnerability in searchresultsmain.php in ZeeLyrics 3x allows remote attackers to inject arbitrary web script or HTML via the keyword parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...