HT Mega < 2.3.4 - Arbitrary Plugin/Theme Activation via CSRF

Description The plugin does not have CSRF checks in various functions in its admin/include/template-library.php file, which could allow attackers to make logged in admins activate plugins/themes via CSRF attacks...

webTareas SQL Injection Vulnerability

webTareas is a web-based open source collaboration tool. The product supports features such as project management, bug tracking, content management and meeting management. A security vulnerability exists in webTareas 2.4 and earlier versions, where an unauthenticated user can perform time and...

CVE-2021-41920

webTareas version 2.4 and earlier allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /includes/library.php, via the sorcible, sorchamps, and sorordre HTTP POST parameters. This allows an attacker to access all the data in the database and obtain...

PT-2021-23453

Name of the Vulnerable Software and Affected Versions webTareas versions 2.4 and earlier Description The issue allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /includes/library.php, via the sor cible, sor champs, and sor ordre HTTP POST...

CVE-2021-41920: Improper Neutralization of Special Elements used in an SQL Command

webTareas version 2.4 and earlier allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /includes/library.php, via the sorcible, sorchamps, and sorordre HTTP POST parameters. This allows an attacker to access all the data in the database and obtain...

CVE-2021-38355

The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the /bug-library.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.3...

PT-2021-22075

Name of the Vulnerable Software and Affected Versions The Bug Library WordPress plugin versions up to and including 2.0.3 Description The issue allows attackers to inject arbitrary web scripts via the successimportcount parameter found in the /bug-library.php file, enabling Reflected Cross-Site...

CVE-2021-38355: Improper Neutralization of Input During Web Page Generation

The Bug Library WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the successimportcount parameter found in the /bug-library.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.3...

U.S. Dept Of Defense: [SQLI ]Time Bassed Injection at ██████████ via /██████/library.php?c=G14 parameter

Step-by-step Reproduction Instructions copy the request to your burp suite : GET /█████████/library.php?c=G14'XORifnow=sysdate,sleep11,0OR' HTTP/1.1 Host: ██████ Accept-Encoding: gzip, deflate Accept: / Accept-Language: en User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36...

PT-2019-13019

Name of the Vulnerable Software and Affected Versions Quest KACE Systems Management Appliance Server Center version 9.1.317 Description A reflected XSS issue exists in the userui/software library.php component via the PATH INFO. Recommendations For version 9.1.317, consider restricting access to...

PT-2019-13020

Name of the Vulnerable Software and Affected Versions Quest KACE Systems Management Appliance Server Center version 9.1.317 Description The issue concerns a SQL injection problem. The affected file is software library.php, and the vulnerable parameters are order0column and order0dir...

PT-2018-14732

Name of the Vulnerable Software and Affected Versions PopojiCMS version 2.0.1 Description An issue in admin library.php allows remote attackers to delete arbitrary files via directory traversal in the "po-admin/route.php?mod=library&act=delete" endpoint, specifically using the id parameter...

worldvet.org XSS vulnerability

Open Bug Bounty ID: OBB-659561 Description| Value ---|--- Affected Website:| worldvet.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

theallianceforec.org XSS vulnerability

Vulnerable URL: http://www.theallianceforec.org/library.php?c=2%27%22%3E%3Csvg/onload=confirm/OPENBUGBOUNTY/%3E=298 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 05.01.2018 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 7314939 VIP websi...

wrekage.org XSS vulnerability

Vulnerable URL: http://www.wrekage.org/library.php?artists=A%27%22%3E%3Csvg/onload=confirm/OPENBUGBOUNTY/%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 9894128 VIP website status:| No Coordinated Disclosure...

Veryide 2.1 /library.php SQL注入漏洞

No description provided by source...

CVE-2008-2044: Improper Control of Generation of Code

includes/library.php in netOffice Dwins 1.3 p2 compares the demoSession variable to the 'true' string literal instead of the true boolean literal, which allows remote attackers to bypass authentication and execute arbitrary code by setting this variable to 1, as demonstrated by uploading a PHP...