Cross-Site Scripting (XSS)

pear/httprequest2 is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the lack of proper sanitization and escaping of user input in the affected files tests/network/getparameters.php and tests/network/postparameters.php, which allows GET and POST parameters to be reflected...

CVE-2025-29180

In FOXCMS =1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The urlprefix, domain, and mywebsite POST parameters are directly concatenated into SQL statements without filtering...

PEAR HTTP_Request2 vulnerable to Cross-site Scripting

In PEAR HTTPRequest2 before 2.7.0, multiple files in the tests directory, notably tests/network/getparameters.php and tests/network/postparameters.php, reflect any GET or POST parameters, leading to XSS...

PT-2025-17203 · Foxcms · Foxcms

Name of the Vulnerable Software and Affected Versions: FOXCMS versions 1.25 and earlier Description: The issue concerns a time-based blind SQL injection vulnerability in the installdb.php file. The url prefix, domain, and my website POST parameters are directly concatenated into SQL statements...

CVE-2025-29180

In FOXCMS =1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The urlprefix, domain, and mywebsite POST parameters are directly concatenated into SQL statements without filtering...

HTTP_Request2 安全漏洞

HTTPRequest2 is a PEAR open source that provides an easy way to perform HTTP requests and does not require the curl extension. A security vulnerability exists in HTTPRequest2 versions prior to 2.7.0 that originates from multiple files in the test directory reflecting GET or POST parameters, which...

CVE-2024-28803

Cross-site scripting XSS vulnerability in Italtel S.p.A. i-MCS NFV v.12.1.0-20211215 allows unauthenticated remote attackers to inject arbitrary web script or HTML into HTTP/POST parameter...

CVE-2019-5072

An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi Route AC9V1.0 Firmware V15.03.05.16multiTRU. A specially crafted HTTP POST request can cause a command injection in the DNS2 post...

Selesta Visual Access Manager SQL Injection Vulnerability (CNVD-2025-22659)

Selesta Visual Access Manager is a visual access manager from Selesta. Selesta Visual Access Manager suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements, which can be exploited by an attacker to perform SQL injection...

Selesta Visual Access Manager SQL Injection Vulnerability (CNVD-2025-22579)

Selesta Visual Access Manager is a visual access manager from Selesta. Selesta Visual Access Manager suffers from a SQL injection vulnerability that can be exploited by an attacker to perform SQL injection in multiple POST parameters of /var/vamanagraph.php...

CVE-2023-42248

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can write arbitrary files by manipulating POST parameters of the page "common/vamSql.php"...

CVE-2023-42244

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vamvisits.php...

CVE-2023-42239

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vamep.php...

CVE-2023-42240

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /monitor/sscheduledfile.php...

CVE-2023-42238

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vameps.php...

CVE-2023-42241

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vamanagraphic.php...

CVE-2023-42244

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vamvisits.php...

Selesta Visual Access Manager 安全漏洞

Selesta Visual Access Manager is a visual access manager from Selesta. Selesta Visual Access Manager suffers from a SQL injection vulnerability that can be exploited by an attacker to perform SQL injection in multiple POST parameters of /var/vamanagraph.php...

PT-2025-1464 · Selesta · Selesta Visual Access Manager

Name of the Vulnerable Software and Affected Versions: Selesta Visual Access Manager VAM versions prior to 4.42.2 Description: An issue was discovered in Selesta Visual Access Manager VAM where an authenticated attacker can perform SQL Injection in multiple POST parameters of the "/vam/vam eps.ph...

CVE-2023-42239

CVE-2023-42239 affects Selesta Visual Access Manager (VAM) prior to version 4.42.2. Multiple connected sources confirm an authenticated SQL Injection vulnerability in POST parameters of the /vam/vam_ep.php endpoint. The issue arises from improper handling/validation of input, enabling an attacker...