16043 matches found
CVE-2015-9428
The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters...
CVE-2015-9427
The googmonify plugin through 0.5.1 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=googmonify.php PID or AID parameter...
CVE-2015-6510
Multiple cross-site scripting XSS vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 srctrack, 2 usemfstmpsize, or 3 usemfsvarsize parameter to systemadvancedmisc.php; the 4 port, 5 snaplen, or 6 count parameter to diagpacketcapture.php...
CVE-2018-8879
Stack-based buffer overflow in Asuswrt-Merlin firmware for ASUS devices older than 384.4 and ASUS firmware before 3.0.0.4.382.50470 for devices allows remote attackers to execute arbitrary code by providing a long string to the blocking.asp page via a GET or POST request. Vulnerable parameters ar...
CVE-2019-8954
In Indexhibit 2.1.5, remote attackers can execute arbitrary code via the v parameter in conjunction with the id parameter in a updjxcode=true action to the ndxzstudio/?a=system URI...
CVE-2019-5256
Certain Huawei products AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981 have a null pointer dereference vulnerability. The system dereferences a pointe...
CVE-2019-6968
The web interface of the D-Link DVA-5592 20180823 is vulnerable to XSS because HTML form parameters are directly reflected...
CVE-2019-11406
Subrion CMS 4.2.1 allows core/en/contacts/ XSS via the name, email, or phone parameter...
CVE-2019-13472
PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file...
CVE-2019-19846
In Joomla! before 3.9.14, the lack of validation of configuration parameters used in SQL queries caused various SQL injection vectors...
CVE-2019-17418
An issue was discovered in MetInfo 7.0. There is SQL injection via the admin/?n=language=languagegeneral=doSearchParameter appno parameter, a different issue than CVE-2019-16997...
CVE-2018-17840
SQL injection exists in Scriptzee Education Website 1.0 via the collegelist.html subject, city, or country parameter...
CVE-2019-14792
The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectanglename or rectangleopacity parameter...
CVE-2018-17374
SQL Injection exists in the Auction Factory 4.5.5 component for Joomla! via the filterorderDir or filterorder parameter...
CVE-2019-0380
Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values to be part of the application logs leading to Information Disclosure...
CVE-2018-11649
Hue 3.12 has XSS via the /pig/save/ name and script parameters...
CVE-2018-20140
Zenphoto 1.4.14 has multiple cross-site scripting XSS vulnerabilities via different URL parameters...
CVE-2019-13076
Quest KACE Systems Management Appliance Server Center 9.1.317 is vulnerable to SQL injection. An authenticated user has the ability to execute arbitrary commands against the database. The affected component is /userui/ticketlist.php, and affected parameters are order0column and order0dir...