CVE-2021-28845

Null Pointer Dereference vulnerability exists in TRENDnet TEW-755AP 1.11B03, TEW-755AP2KAC 1.11B03, TEW-821DAP2KAC 1.11B03, and TEW-825DAP 1.11B03, which could let a remote malicious user cause a denial of service by sending the POST request to applycgi via the lang action without a language key...

CVE-2021-39368

Canon Oce Print Exec Workgroup 1.3.2 allows XSS via the lang parameter...

CVE-2020-23171

A vulnerability in all versions of Nim-lang allows unauthenticated attackers to write files to arbitrary directories via a crafted zip file with dot-slash characters included in the name of the crafted file...

CVE-2020-22533

Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameter...

CVE-2020-20589

Cross Site Scripting XSS vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag...

CVE-2011-4950

Cross-site scripting XSS vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line EPL before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2015-10058

A vulnerability, which was classified as problematic, was found in Wikisource Category Browser. This affects an unknown part of the file index.php. The manipulation of the argument lang leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named...

CVE-2015-1347

Cross-site scripting XSS vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2012-1671

Directory traversal vulnerability in index.php in phpPaleo 4.8b155 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the lang parameter...

CVE-2003-0061

Buffer overflow in passwd for HP UX B.10.20 allows local users to execute arbitrary commands with root privileges via a long LANG environment variable...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via specifically crafted search templates with Mustache functions. An attacker can cause the Elasticsearch node to crash by sending malicious search templates. Details Denial of Service DoS describes a family of...

CVE-2025-46657

Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI...

CVE-2025-46657

Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI...

CVE-2025-46657

Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI...

CVE-2025-46657

Karaz Karazal (through 2025-04-14) is affected by a reflected XSS vulnerability in the lang parameter to the default URI. The public documentation identifies the vulnerable component as Karaz Karazal and the issue arises from insufficient input neutralization during page generation. Severity vari...

PT-2025-18004 · Unknown · Karaz Karazal

Name of the Vulnerable Software and Affected Versions: Karaz Karazal through 2025-04-14 Description: The issue allows reflected XSS via the lang parameter to the default URI. This can lead to improper neutralization of input during web page generation, also known as cross-site scripting...

CVE-2025-46657

Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI...

Karaz Karazal 安全漏洞

Karaz Karazal is an innovative digital platform from Karaz that provides intelligent business solutions and services. A security vulnerability exists in Karaz Karazal version 2025-04-14 and earlier, which stems from a parameter lang leading to reflective cross-site scripting...

CVE-2025-46657

Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI...

CVE-2025-3680

A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this vulnerability is an unknown functionality of the component LANG Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to...