CVE-2020-17386

Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system...

Web-Torghi KS Access Password Disclosure

The vulnerability of the automated information system “Web-Torghi KS” is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain users’ access passwords for the AIIS by changing the...

Cross site scripting

ilchCMS 2.1.23 allows XSS via the index.php/partner/index Link parameter...

PT-2020-10498

Name of the Vulnerable Software and Affected Versions ilchCMS version 2.1.23 Description The issue allows for XSS via the Link parameter in the "index.php/partner/index" endpoint. Recommendations For ilchCMS version 2.1.23, avoid using the Link parameter in the "index.php/partner/index" endpoint...

CVE-2019-20522: Improper Neutralization of Input During Web Page Generation

ilchCMS 2.1.23 allows XSS via the index.php/partner/index Link parameter...

CVE-2018-18673

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "Menu Link" parameter, aka the adm/menulistupdate.php melink parameter...

CVE-2018-18673

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "Menu Link" parameter, aka the adm/menulistupdate.php melink parameter...

Code injection

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "Menu Link" parameter, aka the adm/menulistupdate.php melink parameter...

CVE-2018-18673

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "Menu Link" parameter, aka the adm/menulistupdate.php melink parameter...

PT-2019-9619 · Gnuboard · Gnuboard5

Name of the Vulnerable Software and Affected Versions: GNUBOARD5 version 5.3.1.9 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the me link parameter, also known as the "Menu Link" parameter, in the adm/menu list update.php endpoint. This can be exploite...

MiniCMS Cross-Site Scripting Vulnerability

MiniCMS is a mini content management system CMS designed for personal websites. A cross-site scripting vulnerability exists in MiniCMS version 1.10. A remote attacker can exploit this vulnerability by sending the 'sitelink' parameter to the mc-admin/conf.php file to execute commands...

UBUNTU-CVE-2017-0370

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter...

CVE-2017-0370

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter...

CVE-2017-0370: Improper Input Validation

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter...

CVE-2017-17102

Fiyo CMS 2.0.7 has SQL injection in /system/site.php via $REQUEST'link'...

Wordpress plugin Social Stream API secret key information leakage vulnerability

WordPress is a blogging platform developed using the PHP language that allows users to set up their own websites on servers that support PHP and MySQL databases. Wordpress plugin Social-Stream uses the Twitter API key as a parameter of the URL link There is an information leakage that can be...

PT-2015-7632

Name of the Vulnerable Software and Affected Versions Kentico CMS versions 8.2 through 8.2.41 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the link parameter in the CMSPages/GetDocLink.ashx endpoint. Recommendatio...

CVE-2015-7823: Undefined Security Weakness

Open redirect vulnerability in CMSPages/GetDocLink.ashx in Kentico CMS 8.2 through 8.2.41 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the link parameter...

Khan Academy: Html injection on khanacademy

There's an HTML Injection Vulnerability exists in khanacademy . Affected parameters "linkSuccess=" Steps to reproduce: 1. first open your account on khanacademy. 2.enter the link in the url box. http://khanacademy.org/settings/account?linkSuccess= 3.set any text after "=" eg...

LANDesk Management Suite Remote File Inclusion (CVE-2014-5362)

A remote file inclusion vulnerability has been reported in LANDesk Management Suite. The vulnerability is due to insufficient input validation in the HTTP path. A remote attacker could exploit the remote file inclusion vulnerability by enticing a user to click on a link with a malicious parameter...