QSAN Storage Manager 跨站脚本漏洞

QSAN Storage Manager is a NAS operating system from Quantium Technology Corporation QSAN. A security vulnerability exists in QSAN Storage Manager that stems from the title page parameter not filtering special characters. A remote attacker can inject JavaScript and launch a reflective XSS attack t...

CVE-2021-35967

The CVE-2021-35967 entry describes a Path Traversal vulnerability in the Orca HCM digital learning platform. The issue arises because the directory page parameter does not filter special characters, allowing remote attackers to access the system directory without authentication. The vulnerability...

Cross site scripting

A cross-site scripting XSS vulnerability in wp-content/plugins/event-espresso-core-reg/adminpages/messages/templates/eemsgadminoverview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page paramete...

CVE-2020-26153

A cross-site scripting XSS vulnerability in wp-content/plugins/event-espresso-core-reg/adminpages/messages/templates/eemsgadminoverview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page paramete...

Blackcat Cms 跨站脚本漏洞

Blackcat Cms is a Php-based content management system from the Blackcat team. A cross-site scripting vulnerability exists in BlackCat CMS version 1.3.6, which can be exploited by an authenticated attacker to execute arbitrary web script or HTML via a crafted payload with the "Add Page" parameter...

CVE-2021-23854

An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting XSS in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected...

Buffer overflow

Xerox Phaser 6510 before 64.65.51 and 64.59.11 Bridge, WorkCentre 6515 before 65.65.51 and 65.59.11 Bridge, VersaLink B400 before 37.65.51 and 37.59.01 Bridge, B405 before 38.65.51 and 38.59.01 Bridge, B600/B610 before 32.65.51 and 32.59.01 Bridge, B605/B615 before 33.65.51 and 33.59.01 Bridge,...

CVE-2021-28672

Xerox Phaser 6510 before 64.65.51 and 64.59.11 Bridge, WorkCentre 6515 before 65.65.51 and 65.59.11 Bridge, VersaLink B400 before 37.65.51 and 37.59.01 Bridge, B405 before 38.65.51 and 38.59.01 Bridge, B600/B610 before 32.65.51 and 32.59.01 Bridge, B605/B615 before 33.65.51 and 33.59.01 Bridge,...

Xerox Phaser 安全漏洞

The Xerox Phaser 6510 is a printer from the American company Xerox. It provides printing functionality. A security vulnerability exists in Xerox Phaser that allows remote attackers to execute arbitrary code via a buffer overflow in the processing of Web page parameters. The following products and...

CVE-2021-27526

A cross-site scripting XSS vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "page" parameter...

DynPG 安全漏洞

DynPG is a free open source software for managing web content and modules while focusing on business process automation. A cross-site scripting vulnerability exists in DynPG 4.9.2. A remote attacker can exploit this vulnerability by injecting JavaScript via the "page" parameter...

PHPGurukul Online Book Store SQL注入漏洞

Online BookStore is an online bookstore program. There is a sql injection vulnerability in Online Book Store v1.0. The vulnerability is caused by the id parameter in detail.php not filtering special characters, and an attacker can execute arbitrary SQL statements through this vulnerability...

CVE-2021-22875

Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the setPerPage parameter...

Hgiga MailSherlock SQL注入漏洞

HGiga MailSherlock is an email archiving and auditing system that provides a complete email security solution. HGiga MailSherlock suffers from a SQL injection vulnerability. An attacker can use this vulnerability to inject and execute SQL commands in the URL parameters of a specific cgi page...

CVE-2020-29227

An issue was discovered in Car Rental Management System 1.0. An unauthenticated user can perform a file inclusion attack against the /index.php file with a partial filename in the "page" parameter, to cause local file inclusion resulting in code execution...

PT-2020-17111 · Unknown · Car Rental Management System

Name of the Vulnerable Software and Affected Versions: Car Rental Management System version 1.0 Description: An issue was discovered in the Car Rental Management System where an unauthenticated user can perform a file inclusion attack against the "/index.php" file with a partial filename in the...

CVE-2020-8887

Telestream Tektronix Medius before 10.7.5 and Sentry before 10.7.5 have a SQL injection vulnerability allowing an unauthenticated attacker to dump database contents via the page parameter in a page=login request to index.php aka the server login page...

Sql injection

Telestream Tektronix Medius before 10.7.5 and Sentry before 10.7.5 have a SQL injection vulnerability allowing an unauthenticated attacker to dump database contents via the page parameter in a page=login request to index.php aka the server login page...

UBUNTU-CVE-2020-10946

Cross-site scripting XSS vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5,...

Waychar enrollment system aj***.php page pa***_ne*** parameter has SQL injection vulnerability

Waychar Enrollment System is a PHP/MYSQL based enrollment system. A SQL injection vulnerability exists in the aj.php page pane parameter of Waychar enrollment system, which can be exploited by an attacker to obtain sensitive information from the database...