CVE-2018-14929

Matera Banco 1.0.0 is vulnerable to multiple reflected XSS, as demonstrated by the /contingency/web/index.jsp aka home page url parameter...

Security Bulletin: OpenSource Apache Struts vulnerability in IBM Content Collector for Microsoft SharePoint

Summary Apache Struts could allow a remote attacker to bypass security restrictions, caused by an error in the MultiPageValidator implementation. An attacker could exploit this vulnerability using a modified page parameter to bypass restrictions and launch further attacks on the system...

Biometric Shift Employee Management System Arbitrary File Download Vulnerability

Biometric Shift Employee Management System is an employee management system. An arbitrary file download vulnerability exists in Biometric Shift Employee Management System. An attacker can download arbitrary files via a directory traversal sequence in the index.php formfilename parameter of the...

CVE-2017-17989

Biometric Shift Employee Management System has XSS via the index.php holidayname parameter in an editholiday action...

WordPress ResAds Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation of a set of PHP language development of blogging platform , the platform supports in PHP and MySQL server set up personal blog site.ResAds plugin is used in one of the display formatting plugin for adaptation to a variety of endpoints. A cross-site...

Piwigo 'name' Parameter Cross-Site Scripting Vulnerability

Piwigo is a web-based photo album software from Piwigo team. The software supports photo publishing, management, multiple browsing category, tag, time, etc. Batch Manager component is one of the manager components. A cross-site scripting vulnerability exists in Piwigo version 2.9.2. A remote...

CVE-2017-17059

XSS exists in the amtyThumb amty-thumb-recent-post aka amtyThumb posts or wp-thumb-post plugin 8.1.3 for WordPress via the query string to amtyThumbPostsAdminPg.php...

Harbin Fengteng E-commerce Co., Ltd. SQL injection vulnerability exists in class_id parameter of pic.php page of Fengteng E-commerce station building system.

Fengteng e-commerce website building system is a website building system. Harbin Fengteng E-commerce Co., Ltd. fengteng e-commerce station building system pic.php page classid parameter SQL injection vulnerability, an attacker can exploit the vulnerability to obtain database sensitive information...

SQL injection vulnerability in JYmusic UserController.class.php page s parameter

JYmusic is an open source cross-platform music management system. A SQL injection vulnerability exists in the JYmusic UserController.class.php page s parameter. A remote attacker can exploit the vulnerability to obtain sensitive database information...

PT-2017-3787 · Mitel · Shoretel Connect Onsite

Name of the Vulnerable Software and Affected Versions: ShoreTel Connect ONSITE version 18.82.2000.0 Description: A reflected Cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the page parameter. This is related to the lack of protection measures for...

Piwigo cross-site scripting vulnerability (CNVD-2017-08783 )

Piwigo is a web-based photo album software from the Piwigo team. The software supports photo publishing, management, multiple browsing options categories, tags, time and more. A cross-site scripting vulnerability exists in the admin.php file in Piwigo 2.9.0 and earlier versions. A remote attacker...

Zen Cart Cross-Site Scripting Vulnerability (CNVD-2017-08298)

Zen Cart is an open source shopping cart system developed by Zen Cart team. The system is mainly used to establish an online store , can support a variety of payment methods , multi-language options , online shopping mall batch update and so on. A cross-site scripting vulnerability exists in the...

CVE-2017-8833

Zen Cart 1.6.0 has XSS in the mainpage parameter to index.php. NOTE: 1.6.0 is not an official release but the vendor's README.md file offers a link to v160.zip with a description of "Download latest in-development version from github."...

Cross site scripting

Cross-site scripting vulnerability in Olive Diary DX allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2016-7841

Cross-site scripting vulnerability in Olive Diary DX allows remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2016-7841

Cross-site scripting vulnerability in Olive Diary DX allows remote attackers to inject arbitrary web script or HTML via the page parameter...

AuroMeera Technometrix Pvt Cross-Site Scripting Vulnerability

eMLi is a comprehensive education management suite from AuroMeera Technometrix Pvt for educational institutions in India and globally. A cross-site scripting vulnerability in core-eMLi of AuroMeera Technometrix Pvt's eMLi allows an attacker to send malicious code as a browser-side script to...

CVE-2017-7621

Cross Site Scripting Vulnerability in core-eMLi in AuroMeera Technometrix Pvt. Ltd. eMLi V1.0 allows an Attacker to send malicious code, generally in the form of a browser-side script, to a different end user via the page parameter to code/studentportal/home.php. The affected versions are eMLi...

SemCms /semcms/view.php page ID parameter has SQL injection vulnerability

SemCms is a set of open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox and other mainstream browsers.SemCms using php and vb language writing, combined with apache or iis running. SemCms /semcms/view.php page ID...

Input validation

A vulnerability in the web framework of Cisco IOS XE Software could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of HTTP parameters supplied by the user. An attacker could...