CVE-2022-36462

TOTOLINK A3700R V9.1.2u.6134B20201202 was discovered to contain a stack overflow via the lang parameter in the function setLanguageCfg...

CVE-2021-39368

Canon Oce Print Exec Workgroup 1.3.2 allows XSS via the lang parameter...

CVE-2020-22533

Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameter...

CVE-2011-4950

Cross-site scripting XSS vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2015-1347

Cross-site scripting XSS vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2012-1671

Directory traversal vulnerability in index.php in phpPaleo 4.8b155 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

CVE-2025-46657

Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI...

CVE-2025-46657

Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI...

CVE-2025-46657

Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI...

CVE-2025-46657

Karaz Karazal (through 2025-04-14) is affected by a reflected XSS vulnerability in the lang parameter to the default URI. The public documentation identifies the vulnerable component as Karaz Karazal and the issue arises from insufficient input neutralization during page generation. Severity vari...

PT-2025-18004 · Unknown · Karaz Karazal

Name of the Vulnerable Software and Affected Versions: Karaz Karazal through 2025-04-14 Description: The issue allows reflected XSS via the lang parameter to the default URI. This can lead to improper neutralization of input during web page generation, also known as cross-site scripting...

CVE-2025-46657

Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI...

Karaz Karazal 安全漏洞

Karaz Karazal is an innovative digital platform from Karaz that provides intelligent business solutions and services. A security vulnerability exists in Karaz Karazal version 2025-04-14 and earlier, which stems from a parameter lang leading to reflective cross-site scripting...

CVE-2025-46657

Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI...

PT-2025-12016

Name of the Vulnerable Software and Affected Versions: Age Gate plugin for WordPress versions up to, and including, 3.5.3 Description: The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion via the lang parameter. This allows unauthenticated attackers to include and execute...

WordPress Age Gate plugin <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang' vulnerability

Unauthenticated Local PHP File Inclusion via 'lang' vulnerability discovered by mikemyers in WordPress Plugin Age Gate versions = 3.5.3...

VulnCheck KEV: CVE-2025-2505

The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of code in...

WordPress plugin Quran multilanguage Text & Audio 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the WordPress plugi...

PT-2024-17376 · WordPress · Quran Multilanguage Text & Audio

Name of the Vulnerable Software and Affected Versions: The Quran multilanguage Text & Audio plugin for WordPress versions prior to 2.3.22 Description: The issue is related to Reflected Cross-Site Scripting via the sourate and lang parameters due to insufficient input sanitization and output...

PT-2024-16699 · WordPress · Fileorganizer

Name of the Vulnerable Software and Affected Versions: FileOrganizer – Manage WordPress and Website Files plugin for WordPress versions up to, and including, 1.1.4 Description: The issue allows authenticated attackers with Administrator-level access and above to include and execute arbitrary file...