CVE-2026-25220: Authorization Bypass Through User-Controlled Key

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Message Center accepts the URL parameter showall=yes and passes it to getPnotesByUser, which returns all internal messages all users’ notes. The backend does not...

EUVD-2005-3158

Malware in sbrugna...

EUVD-2017-6761

Malware in sbrugna...

EUVD-2005-3870

Malware in sbrugna...

EUVD-2005-4000

Malware in sbrugna...

EUVD-2023-23745

Malicious code in bioql PyPI...

CVE-2023-1498

A vulnerability classified as critical has been found in code-projects Responsive Hotel Site 1.0. Affected is an unknown function of the file messages.php of the component Newsletter Log Handler. The manipulation of the argument title leads to sql injection. It is possible to launch the attack...

CVE-2017-15305

XSS exists in NexusPHP 1.5 via the keyword parameter to messages.php...

PT-2023-17034

Name of the Vulnerable Software and Affected Versions code-projects Responsive Hotel Site version 1.0 Description A critical vulnerability has been found in the Newsletter Log Handler component of the code-projects Responsive Hotel Site. The issue is related to the manipulation of the title...

CVE-2023-1498: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability classified as critical has been found in code-projects Responsive Hotel Site 1.0. Affected is an unknown function of the file messages.php of the component Newsletter Log Handler. The manipulation of the argument title leads to sql injection. It is possible to launch the attack...

Teameyo Project Management System 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Teameyo - Project Management System 1.0 - SQL Injection Exploit Author: Ihsan Sencan Vendor Homepage: https://www.teameyo.com/ Software Link: https://codecanyon.net/item/teameyo-project-management-system/23142804 Version: 1.0...

NexusPHP Cross-Site Scripting Vulnerability (CNVD-2017-32401)

NexusPHP is a resource sharing community solution written in PHP developed by the Nexus team in China. A cross-site scripting vulnerability exists in NexusPHP version 1.5. A remote attacker can exploit this vulnerability by sending the 'keyword' parameter to the messages.php file to obtain the...

Cross site scripting

XSS exists in NexusPHP 1.5 via the keyword parameter to messages.php...

CVE-2017-15305

XSS exists in NexusPHP 1.5 via the keyword parameter to messages.php...

CVE-2017-15305

The CVE-2017-15305 entry describes a cross-site scripting (XSS) vulnerability in NexusPHP 1.5 exploitable via the keyword parameter to messages.php. Multiple connected records (CNVD-2017-32401, RH:CVE-2017-15305, NVD/CVE-2017-15305, PRION/CVE-2017-15305, CVELIST/CVE-2017-15305) corroborate an XSS...

CVE-2017-15305: Improper Neutralization of Input During Web Page Generation

XSS exists in NexusPHP 1.5 via the keyword parameter to messages.php...

PT-2015-7038

Name of the Vulnerable Software and Affected Versions Symantec Web Gateway versions prior to 5.2.2 DB 5.0.0.1277 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in PHP scripts within the management console of Symantec Web Gateway appliances. These vulnerabilities...

PHP-Fusion 4.0/5.0/6.0 Messages.PHP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/14489/info PHP-Fusion is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'messages.php' script before using it in an SQL query...

CVE-2014-4583: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in forms/messages.php in the WP-Contact wp-contact-sidebar-widget plugin 1.0 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 edit, 2 orderdirection, 3 limitstart, 4 id, or 5 order parameter...

CVE-2013-1804: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the 1 highlight parameter to forum/viewthread.php; or remote authenticated users with certain permissions to inject arbitrary web script or HTML via the...