EUVD-2026-53318

Mautic's getLeadIdsByFieldValueAction LeadBundle/Controller/AjaxController.php reads a field parameter from the request, sanitizes it only with InputHelper::clean which HTML-entity-encodes quotes and angle brackets but does not restrict other characters, and passes it into...

EUVD-2022-52121

Malicious code in bioql PyPI...

EUVD-2022-50618

Malicious code in bioql PyPI...

EUVD-2022-50621

Malicious code in bioql PyPI...

EUVD-2022-50616

Malicious code in bioql PyPI...

EUVD-2022-50619

Malicious code in bioql PyPI...

EUVD-2022-50623

Malicious code in bioql PyPI...

EUVD-2022-50617

Malicious code in bioql PyPI...

EUVD-2022-50622

Malicious code in bioql PyPI...

CVE-2025-5240: Improper Neutralization of Input During Web Page Generation

The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2022-47865

Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeOrder.php...

CVE-2022-47862

Lead Management System v1.0 is vulnerable to SQL Injection via the customerid parameter in ajaxrepresent.php...

CVE-2022-47864

Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeCategories.php...

CVE-2022-47860

Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeProduct.php...

CVE-2022-47861

Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeLead.php...

CVE-2022-47859

Lead Management System v1.0 is vulnerable to SQL Injection via the userid parameter in changePassword.php...

CVE-2022-47866

Lead management system v1.0 is vulnerable to SQL Injection via the id parameter in removeBrand.php...

WordPress plugin CRM and Lead Management by vcita 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPre...

CVE-2024-13702: Improper Neutralization of Input During Web Page Generation

The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vCitaMeetingScheduler' and 'vCitaSchedulingCalendar' shortcodes in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping on user...

CVE-2024-13703

The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcitaajaxtoggleae function in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with Subscriber-level...