Cross site scripting

Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameter...

CVE-2020-22533

Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameter...

Zentao 跨站脚本漏洞

Nature Easy Soft Network Technology ZenTao is China's easy soft Tianchuang network technology Nature Easy Soft Network Technology company's open source project management software. The software includes product management, project management, quality management and document management functions. ...

PT-2023-11621 · Zentao · Zentao

Name of the Vulnerable Software and Affected Versions: Zentao affected versions not specified Description: A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the lang parameter. This enables the attacker to inject malicious scripts into the website, potentially...

CVE-2020-22533

Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameter...

SUSE CVE-2001-1350

Cross-site scripting vulnerability in namazu.cgi for Namazu 2.0.7 and earlier allows remote attackers to execute arbitrary Javascript as other web users via the lang parameter...

SUSE CVE-2006-2031

Cross-site scripting XSS vulnerability in index.php in phpMyAdmin 2.8.0.3, 2.8.0.2, 2.8.1-dev, and 2.9.0-dev allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

SUSE CVE-2022-0813

PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pmaparameter, and the cookie section...

CVE-2015-10058

CVE-2015-10058 affects Wikisource Category Browser, with the vulnerability located in the index.php file. The issue stems from manipulation of the lang parameter, enabling cross-site scripting (XSS). It is described as exploitable remotely. A patch is identified as 764f4e8ce3f9242637df77530c70ae8...

Wikisource Category Browser 跨站脚本漏洞

Wikisource Category Browser is a Wikisource open source application. Wikisource Category Browser suffers from a cross-site scripting vulnerability that stems from the fact that incorrect manipulation of the parameter lang can lead to cross-site scripting...

Remote Code Execution (RCE)

topthink/framework is vulnerable to remote execution. The vulnerability exists because the lang parameter is not properly validated, which allows a remote attacker to inject and execute arbitrary commands...

ThinkPHP 路径遍历漏洞

ThinkPHP is a PHP-based, open source, lightweight web application development framework from China's Top Thinking Information Technology Company. A security vulnerability exists in ThinkPHP Framework versions prior to 6.0.14, which originates from allowing local files to be included via the lang...

CVE-2022-47945

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled langswitchon=true. An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php...

TOTOLINK LR350 缓冲区错误漏洞

TOTOLINK LR350 is a 4G LTE router from China's Gion Electronics TOTOLINK that supports converting 4G signals to wired signals for home and office scenarios. A buffer overflow vulnerability exists in the TOTOLINK LR350. The vulnerability stems from a buffer overflow after validation via the...

SQL Injection via lang parameter/RCE when PostgreSQL is used

Description There is a SQL injection vulnerability in the lang parameter of phpmyfaq/ajaxservice.php?action=savefaq endpoint. Vulnerable code starts at ajaxservice.php line 369, specifically the isnull$faqId && !isnull$categories'rubrik' part: php if !isnull$author && !isnull$email &&...

CVE-2022-41517

TOTOLINK NR1800X V9.1.0u.6279B20210910 was discovered to contain a stack overflow in the lang parameter in the setLanguageCfg function...

CVE-2022-41517

TOTOLINK NR1800X V9.1.0u.6279B20210910 was discovered to contain a stack overflow in the lang parameter in the setLanguageCfg function...

CVE-2022-41517

TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a stack overflow in the lang parameter inside the setLanguageCfg method. The root cause is lack of length validation for input data, which can enable arbitrary code execution. Multiple sources (CNVD/CNNVD, NVD, Red Hat, CVE listing) corroborate the...

CVE-2022-38308

TOTOLink A700RU V7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the lang parameter in the function cstesystem. This vulnerability allows attackers to execute arbitrary commands via a crafted payload...

CVE-2022-38308

TOTOLink A700RU V7.4cu.2313B20191024 was discovered to contain a command injection vulnerability via the lang parameter in the function cstesystem. This vulnerability allows attackers to execute arbitrary commands via a crafted payload...