COVID19 Testing Management System Input Validation Error Vulnerability

The COVID19 Testing Management System is a new crown pneumonia testing management system. The COVID19 Testing Management System has an input validation error vulnerability that originates from an open redirect due to the operation of the parameter q in the file /search-report-result.php. No detai...

Luna Imaging code injection vulnerability

Luna Imaging is a web-hosted solution for displaying, managing, and preserving digital archival collections from Luna Imaging USA. A code injection vulnerability exists in Luna Imaging version 7.5.5.6 and earlier, which stems from improper manipulation of the parameter q in the file...

PHPGurukul COVID19 Testing Management System: Input validation error vulnerability

The COVID19 Testing Management System is a new crown pneumonia testing management system. The COVID19 Testing Management System has an input validation error vulnerability that originates from an open redirect due to the operation of the parameter q in the file /search-report-result.php. No detai...

CVE-2025-40726: Improper Neutralization of Input During Web Page Generation

Reflected Cross-Site Scripting XSS vulnerability in /pages/search-results-page in Nosto, which allows remote attackers to execute arbitrary code via the q GET request parameter...

CVE-2023-0327

A vulnerability was found in saemorris TheRadSystem. It has been classified as problematic. Affected is an unknown function of the file users.php. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. VDB-218454 is the identifier assigned ...

CVE-2025-28121

code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting XSS in feedback.php via the "q" parameter allowing remote attackers to execute arbitrary code...

CVE-2025-28121: Improper Neutralization of Input During Web Page Generation

code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting XSS in feedback.php via the "q" parameter allowing remote attackers to execute arbitrary code...

Code-Projects Online Exam Mastering System Security Vulnerabilities

Code-Projects Online Exam Mastering System is a Code-Projects open source online exam system. A security vulnerability exists in Code-Projects Online Exam Mastering System version 1.0, which originates from cross-site scripting in the q parameter of feedback.php and could lead to the execution of...

CVE-2025-20226: Exposure of Sensitive Information to an Unauthorized Actor

In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214, a low-privileged user that does not hold the "admin" or "power" Splunk roles could run a saved search with a risky command using the permission...

Portfolio Management System Script Code Execution

The vulnerability of the updateexdetail.php script in the Portfolio Management System is related to the failure to eliminate special elements during the processing of the q parameter. Exploiting this vulnerability allows an attacker who operates remotely to gain unauthorized access to read, modif...

PT-2024-9930 · Unknown · 1000 Projects Portfolio Management System Mca

Name of the Vulnerable Software and Affected Versions: 1000 Projects Portfolio Management System MCA version 1.0 Description: The issue is related to the update ex detail.php script in the Portfolio Management System, where the q parameter is not properly sanitized, leading to a SQL injection...

WordPress plugin G Web Pro Store Locator has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-11682: Improper Neutralization of Input During Web Page Generation

The G Web Pro Store Locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-42697: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Leotheme Leo Product Search Module v.2.1.6 and earlier allows a remote attacker to execute arbitrary code via the q parameter of the product search function...

Leotheme Leo Product Search Module security vulnerabilities

Leotheme Leo Product Search Module is a product search module for a website from Leotheme, Inc. A security vulnerability exists in Leotheme Leo Product Search Module 2.1.6 and earlier versions, which stems from a cross-site scripting vulnerability that allows remote attackers to execute arbitrary...

CVE-2024-42697

Cross Site Scripting vulnerability in Leotheme Leo Product Search Module v.2.1.6 and earlier allows a remote attacker to execute arbitrary code via the q parameter of the product search function...

CVE-2024-43396

Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in...

CVE-2024-43396: Improper Neutralization of Input During Web Page Generation

Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in...

WordPress plugin Admission AppManager has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2023-4507: Improper Neutralization of Input During Web Page Generation

The Admission AppManager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'q' parameter in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...