564 matches found
CVE-2024-11846
The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-11846
The Travel Tour WordPress plugin, specifically versions prior to 5.2.4 , is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitize and escape a parameter before it is output back onto the page. This security flaw could be exploited to target high-pri...
CVE-2024-11846 Travel Tour < 5.2.4 - Reflected XSS
The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
PT-2025-37303
Name of the Vulnerable Software and Affected Versions: Zabbix Agent 2 affected versions not specified Description: The Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, which allows an attacker to inject unexpected arguments into the smartctl command. This can b...
Script Injection
Debezium is vulnerable to script injection. The vulnerability is due to improper sanitization of parameters, allowing attackers to perform a script injection attack that may result in unauthorized data exposure...
PT-2024-16319 · WordPress · Ai Engine
Name of the Vulnerable Software and Affected Versions: AI Engine WordPress plugin versions prior to 2.6.5 Description: The issue concerns a failure to properly sanitize and escape a parameter from one of the plugin's RESP API endpoints before using it in a SQL statement. This allows administrator...
PT-2024-35766 · Siyuan · Siyuan
Name of the Vulnerable Software and Affected Versions: Siyuan version 3.1.11 Description: A SQL injection issue has been identified in Siyuan via the ids array parameter in the "/batchGetBlockAttrs" API endpoint. This allows for potential exploitation. Recommendations: For Siyuan version 3.1.11, ...
CVE-2024-50360
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G = 1.6.3, EKI-6333AC-2GD = v1.6.3 and EKI-6333AC-1GPO = v1.2.1. The source of the vulnerability relies on...
CVE-2023-1419
A script injection vulnerability was found in the Debezium database connector, where it does not properly sanitize some parameters. This flaw allows an attacker to send a malicious request to inject a parameter that may allow the viewing of unauthorized data...
CVE-2024-41714
A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 9.8.1.5 and MiVoice Business Solution Virtual Instance MiVB SVI through 1.0.0.27 could allow an authenticated attacker to conduct a command injection attack, due to insufficient parameter sanitization. A successful...
CVE-2024-35285
A vulnerability in NuPoint Messenger NPM of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization...
CVE-2024-35314
A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance MiVB SVI 1.0.0.25, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit requires user...
CVE-2024-35285
A vulnerability in NuPoint Messenger NPM of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization...
CVE-2024-35314
A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance MiVB SVI 1.0.0.25, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit requires user...
CVE-2024-8625
The TS Poll WordPress plugin before 2.4.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...
CVE-2024-41714
A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 9.8.1.5 and MiVoice Business Solution Virtual Instance MiVB SVI through 1.0.0.27 could allow an authenticated attacker to conduct a command injection attack, due to insufficient parameter sanitization. A successful...
CVE-2024-35314
A command injection vulnerability exists in the Mitel MiCollab Desktop Client (version 9.7.1.110 and earlier) and MiVoice Business Solution Virtual Instance (MiVB SVI) (version 1.0.0.25). The root cause is insufficient parameter sanitization (or failure to neutralize special elements), which coul...
CVE-2024-35285
A vulnerability in NuPoint Messenger NPM of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization...
CVE-2024-41714
A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 9.8.1.5 and MiVoice Business Solution Virtual Instance MiVB SVI through 1.0.0.27 could allow an authenticated attacker to conduct a command injection attack, due to insufficient parameter sanitization. A successful...
CVE-2024-35314
A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance MiVB SVI 1.0.0.25, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit requires user...