CVE-2026-5357: Improper Neutralization of Input During Web Page Generation

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sid' parameter of the 'wpdmmembers' shortcode in versions up to and including 3.3.52. This is due to insufficient input sanitization and output escaping on the user-supplied 'sid' shortcode attribute...

EUVD-2007-1895

Malware in sbrugna...

EUVD-2013-5151

Malware in sbrugna...

EUVD-2006-6265

Malware in sbrugna...

EUVD-2017-9482

Malware in sbrugna...

PT-2024-31683

Name of the Vulnerable Software and Affected Versions: CodeAstro MembershipM-PHP aka Membership Management System in PHP version 1.0 Description: The issue allows for stored XSS in the fullname parameter of the "add members.php" page. This can lead to malicious script execution when the stored da...

CVE-2020-12461

PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sortorder GET parameter on the members.php members search page. This parameter allows for control over anything after the...

Sql injection

PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sortorder GET parameter on the members.php members search page. This parameter allows for control over anything after the...

CVE-2020-12461: Improper Neutralization of Special Elements used in an SQL Command

PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sortorder GET parameter on the members.php members search page. This parameter allows for control over anything after the...

CVE-2017-18364

phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter...

CVE-2017-18364

CVE-2017-18364 concerns phpFK lite and is a reflected cross-site scripting (XSS) vulnerability. The affected components are the web interface files faq.php, members.php, search.php (via query strings) and user.php (via the user parameter). The underlying issue is that user-supplied input in these...

CVE-2017-18364: Improper Neutralization of Input During Web Page Generation

phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter...

CVE-2018-17996: Cross-Site Request Forgery (CSRF)

LayerBB before 1.1.3 allows CSRF for adding a user via admin/newuser.php, deleting a user via admin/members.php/deleteuser/, and deleting content via mod/delete.php/...

natschool.org XSS vulnerability

Open Bug Bounty ID: OBB-677816 Description| Value ---|--- Affected Website:| natschool.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

ncaggregates.org XSS vulnerability

Vulnerable URL: http://ncaggregates.org/old/members.php?label=company=1/-///'/"//--...

syusei.biz XSS vulnerability

Open Bug Bounty ID: OBB-241723 Description| Value ---|--- Affected Website:| syusei.biz Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

fcvb.org XSS vulnerability

Vulnerable URL: http://www.fcvb.org/mobile/members.php?businessName=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 15191753 Google...

tnaflix.com XSS vulnerability

Vulnerable URL: https://www.tnaflix.com/members.php?country===0=1="...

PHP-Fusion 7.02.07 Blind SQL Injection Vulnerability

PHP-Fusion versions 7.02.07 and below suffer from a remote blind SQL injection vulnerability in the admin panel. ============================================= MGC ALERT 2015-002 - Original release date: September 18, 2015 - Last revised: October 05, 2015 - Discovered by: Manuel García Cárdenas -...

PHP-Fusion 7.02.07 Blind SQL Injection

============================================= MGC ALERT 2015-002 - Original release date: September 18, 2015 - Last revised: October 05, 2015 - Discovered by: Manuel García Cárdenas - Severity: 7,1/10 CVSS Base Score ============================================= I. VULNERABILITY...