CVE-2020-18324

Subrion CMS 4.2.1 – Kickstart 模板中的反射型 XSS 漏洞 描述 Subrion CMS 易于安装且管理简单。可将其作为独立应用程序使用，或与其他应用程序结合，用于构建入门级、中型或大型网站。 在 Subrion CMS v.4.2.1 的 "Kickstart" 网页应用模板中，通过 "search" 组件发现了反射型跨站脚本（XSS）漏洞，该漏洞允许远程攻击者注入任意 JavaScript 代码。 日期 ：2022-02-22 软件链接 ：https://subrion.org 漏洞发现者 ：HaMM0nz CVE 编号 ：CVE-2020-18324 ...

CVE-2023-34598

Gibbon v25.0.0 - Inclusión de Archivos Locales - CVE-2023-34598 Gibbon v25.0.0 es vulnerable a una vulnerabilidad de Inclusión de Archivos Locales LFI donde es posible incluir el contenido de varios archivos presentes en la carpeta de instalación en la respuesta del servidor. Prueba de Concepto...

CVE-2024-27956-RCE

CVE-2024-27956-RCE CVE-2024-27956のPoCです。ValvePress AutomaticプラグインにおけるSQLインジェクションです。このPoCは脆弱性を悪用し、ターゲットにユーザーを作成し、管理者権限を付与します。WordPressで管理者になると、リモートコード実行につながる可能性があります。 使い方 root@kitploit: git clone https://github.com/diego-tella/CVE-2024-27956-RCE/ cd CVE-2024-27956-RCE python exploit.py...

CVE-2023-45542

CVE-2023-45542 mooSocial v3.1.8 的搜索功能中的 q 参数存在一个反射型跨站脚本（XSS）漏洞，允许攻击者通过特制 URL 窃取用户的会话 Cookie 并冒充其账户。 漏洞参数：q 漏洞利用 - 概念验证 POC 反射型跨站脚本（XSS） root@kitploit: Payload : test"alert1test FINAL Payload URL encoded : test%22%3e%3cscript%3ealert1%3c%2fscript%3etest 对 http://localhost/moosocial/search/index/q=...

CVE-2025-28121

💥 CVE-2025-28121 - 在线考试精通系统 1.0 反射型XSS漏洞 📝 描述 code-projects 在线考试精通系统 1.0 在 feedback.php 文件中通过 q 参数存在反射型跨站脚本（XSS）漏洞。 该漏洞允许远程攻击者向应用程序注入恶意JavaScript，且该脚本会在响应中直接反射返回，未进行适当的清理或编码。成功利用可能导致Cookie窃取、账户劫持或其他客户端攻击。 🕵️‍♂️ 漏洞详情 字段| 信息 ---|--- CVE ID| CVE-2025-28121 漏洞类型| 跨站脚本（XSS） 受影响组件| feedback.php 攻击类型| 远程...

CVE-2026-73295

Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest...

CVE-2026-73295

Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest...

PT-2026-71146

Name of the Vulnerable Software and Affected Versions Material for MkDocs versions 7.2.0 through 9.7.6 Description The optional search.suggest feature contains a DOM-based cross-site scripting issue. This occurs within the mountSearchSuggest function in...

py-mkdocs-material -- DOM XSS vulnerability

Martin Donath reports: Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction...

CVE-2026-11772

DRIMO CMS is affected by a Reflected XSS in the searching functionality, triggered via the q parameter. The vulnerability allows arbitrary JavaScript execution in the victim’s browser when a crafted URL is opened. The affected software is at end-of-life and no security updates are planned. Mitiga...

CVE-2018-25413

AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'q' parameter. Attackers can send GET requests to search.php with crafted SQL payloads to extract sensitive database informati...

CVE-2018-25413

AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'q' parameter. Attackers can send GET requests to search.php with crafted SQL payloads to extract sensitive database informati...

CVE-2018-25413 AiOPMSD Final 1.0.0 SQL Injection via search.php

AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'q' parameter. Attackers can send GET requests to search.php with crafted SQL payloads to extract sensitive database informati...

CVE-2018-25413

AiOPMSD Final 1.0.0 is affected by an SQL injection in search.php via the q parameter, allowing unauthenticated attackers to execute arbitrary SQL and enumerate usernames, database names, and version details. The CVE entry includes CVSS scores (3.1: base 8.2 HIGH network/low integrity; 4.0: base ...

PT-2026-45113

Name of the Vulnerable Software and Affected Versions AiOPMSD Final version 1.0.0 Description An SQL injection allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code. This is achieved by sending GET requests to the 'search.php' endpoint using the q parameter...

CVE-2026-34400

Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API q= was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version...

GHSA-8PRR-286P-4W7J alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API

Impact The Query string search API q= was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. Patches Fixed in v9.1.0. The Postgres query parser now uses parameterized queries wit...

SQL Injection

Overview alerta-server is an Alerta server WSGI application Affected versions of this package are vulnerable to SQL Injection in the q parameter of the query string API due to direct interpolation of user-supplied input into SQL statements using f-strings. An attacker can execute arbitrary SQL...

CVE-2019-25513

Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'q' parameter. Attackers can send GET requests to datagetir.php with malicious 'q' values using time-based blind...

CVE-2019-25513 Jettweb PHP Hazir Haber Sitesi Scripti V3 SQL Injection via datagetir.php

Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'q' parameter. Attackers can send GET requests to datagetir.php with malicious 'q' values using time-based blind...