CVE-2023-4882: Improper Resource Shutdown or Release

DOS vulnerability that could allow an attacker to register a new VNF Virtual Network Function value. This action could trigger the argsassets function defined in the arg-log.php file, which would then execute the args-abort.c file, causing the service to crash...

PT-2023-15095 · Nexusphp · Nexusphp

Name of the Vulnerable Software and Affected Versions: NexusPHP versions prior to 1.7.33 Description: The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to reflective cross-site scripting XSS attacks. This can be achieved by injecting malicious input int...

CVE-2021-39413

Multiple Cross Site Scripting XSS vulnerabilities exits in SEO Panel v4.8.0 via the 1 totime parameter in a backlinks.php, b analytics.php, c log.php, d overview.php, e pagespeed.php, f rank.php, g review.php, h saturationchecker.php, i socialmedia.php, and j reports.php; the 2 fromtime parameter...

CVE-2021-39413

Multiple Cross Site Scripting XSS vulnerabilities exits in SEO Panel v4.8.0 via the 1 totime parameter in a backlinks.php, b analytics.php, c log.php, d overview.php, e pagespeed.php, f rank.php, g review.php, h saturationchecker.php, i socialmedia.php, and j reports.php; the 2 fromtime parameter...

Cross-site Scripting (XSS)

zoneminder is vulnerable to Cross Site Scripting. The vulnerability exists due to a lack of validation of the 'level' parameter value in the view log log.php...

CVE-2021-39302

MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions'org' value...

Sql injection

MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions'org' value...

CVE-2021-39302

MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions'org' value...

CVE-2021-39302: Improper Neutralization of Special Elements used in an SQL Command

MISP 2.4.148, in certain configurations, allows SQL injection via the app/Model/Log.php $conditions'org' value...

CVE-2020-18191: Improper Limitation of a Pathname to a Restricted Directory

GetSimpleCMS-3.3.15 is affected by directory traversal. Remote attackers are able to delete arbitrary files via /GetSimpleCMS-3.3.15/admin/log.php...

CVE-2017-18591

The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php...

Design/Logic Flaw

The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php...

CVE-2017-18591

The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php...

CVE-2017-18591

Summary: CVE-2017-18591 affects the WordPress gd-rating-system plugin prior to 2.1, with an XSS in log.php. The issue stems from insufficient validation in the log.php handling, enabling possible client-side script execution. Affected software: WordPress site using the gd-rating-system plugin (ve...

CVE-2017-18591: Improper Neutralization of Input During Web Page Generation

The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php...

CVE-2019-7339: Improper Neutralization of Input During Web Page Generation

POST - Cross Site Scripting XSS exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'level' parameter value in the view log log.php because proper filtration is omitted...

Design/Logic Flaw

The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log viewing at the templates/admin/redirect-log.php URI...

CVE-2019-6267: Improper Neutralization of Input During Web Page Generation

The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log viewing at the templates/admin/redirect-log.php URI...

Sql injection

ProjectSend formerly cFTP r582 allows SQL injection via manage-files.php with the request parameter status, manage-files.php with the request parameter files, clients.php with the request parameter selectedclients, clients.php with the request parameter status, process-zip-download.php with the...

CVE-2016-10731

CVE-2016-10731 affects ProjectSend (formerly cFTP) r582 and enables SQL injection via multiple PHP endpoints: manage-files.php (status, files), clients.php (selected_clients, status), process-zip-download.php (file), or home-log.php (action). Root cause: input parameters are used in SQL queries w...