CVE-2026-116217

RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/FoodService/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menuid and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php lin...

EUVD-2026-109809

RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/FoodService/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menuid and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php lin...

CVE-2026-116217 RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php

RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/FoodService/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menuid and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php lin...

CVE-2026-116217

RosarioSIS versions prior to 12.9.2 are vulnerable to a reflected cross-site scripting (XSS) flaw in the modules/Food_Service/MenuReports.php component. The root cause is the failure to properly escape the menu_id and modname parameters. An unauthenticated attacker can craft a malicious Modules.p...

CVE-2026-116217 RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php

RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/FoodService/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menuid and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php lin...

CVE-2026-116217 RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php

RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/FoodService/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menuid and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php lin...

François Jacquet Rosario SIS cross-site scripting vulnerability

François Jacquet Rosario: Versions prior to SIS 12.9.2 contain a cross-site scripting vulnerability. This flaw stems from improper handling of unescaped menuid and modname parameters in modules/FoodService/MenuReports.php. It may lead to reflected XSS attacks. Attackers can trick authenticated...

CVE-2023-5811

A vulnerability, which was classified as problematic, was found in flusity CMS. Affected is the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument menuid leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2023-5811: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in flusity CMS. Affected is the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument menuid leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2020-18215: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL Injection vulnerabilities in PHPSHE 1.7 in phpshe/admin.php via the 1 adid, 2 menuid, and 3 cashoutid parameters, which could let a remote malicious user execute arbitrary code...

Smart Guard Network Manager 6.3.2 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: SQL Injection In Smart Guard Network Manager Api Date: 03/12/2016 Exploit Author: Rahul Raz Vendor Homepage: http://www.xsinfoways.com/ Software Name: Smart Guard Network Manager Version: 6.3.2 Tested on: Ubuntu Linux...

CVE-2008-2351

Multiple SQL injection vulnerabilities in index.php in CMS WebManager-Pro allow remote attackers to execute arbitrary SQL commands via the 1 langid and 2 menuid parameters...

CVE-2008-2351: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in CMS WebManager-Pro allow remote attackers to execute arbitrary SQL commands via the 1 langid and 2 menuid parameters...

CVE-2007-4523: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote authenticated users to inject arbitrary web script or HTML via one or more of the following vectors: the 1 id parameter to a pages/deletepage.php, b navigation/deletemenu.php, and c...

CVE-2006-4072

Multiple SQL injection vulnerabilities in Club-Nuke XP 2.0 LCID 2048 allow remote attackers to execute arbitrary SQL commands via the 1 haberid parameter to haberdetay.asp, and allow remote authenticated users to execute arbitrary SQL commands via the 2 menuid parameter to menu.asp...

CVE-2006-4072

Multiple SQL injection vulnerabilities affect Club-Nuke [XP] 2.0 LCID 2048. The flaws allow remote attackers to execute arbitrary SQL commands via the (1) haber_id parameter to haber_detay.asp and (2) menu_id parameter to menu.asp. Root cause: unsafely constructed SQL queries leading to injection...

CVE-2006-4072: Undefined Security Weakness

Multiple SQL injection vulnerabilities in Club-Nuke XP 2.0 LCID 2048 allow remote attackers to execute arbitrary SQL commands via the 1 haberid parameter to haberdetay.asp, and allow remote authenticated users to execute arbitrary SQL commands via the 2 menuid parameter to menu.asp...