CVE-2023-34598

Gibbon v25.0.0 - Inclusión de Archivos Locales - CVE-2023-34598 Gibbon v25.0.0 es vulnerable a una vulnerabilidad de Inclusión de Archivos Locales LFI donde es posible incluir el contenido de varios archivos presentes en la carpeta de instalación en la respuesta del servidor. Prueba de Concepto...

CVE-2023-45542

CVE-2023-45542 Existe una vulnerabilidad de cross-site scripting XSS reflejado en el parámetro q de la función de búsqueda de mooSocial v3.1.8 que permite a los atacantes robar las cookies de sesión de los usuarios y suplantar su cuenta mediante una URL manipulada. Parámetro vulnerable: q Exploit...

CVE-2024-27956-RCE

CVE-2024-27956-RCE Un PoC para CVE-2024-27956, una inyección SQL en el plugin ValvePress Automatic. Este PoC explota la vulnerabilidad creando un usuario en el objetivo y otorgándole derechos de Administrador. Ser administrador en WordPress puede conducir a la Ejecución Remota de Código. Uso...

CVE-2020-18324

Subrion CMS 4.2.1 – Vulnerabilidad XSS Reflejada en la plantilla Kickstart Description Subrion CMS es fácil de instalar y simple de administrar. Úselo como una aplicación independiente o en conjunto con otras aplicaciones para crear sitios de nivel básico, medianos o grandes. La vulnerabilidad de...

CVE-2025-28121

💥 CVE-2025-28121 - XSS Reflejado en Online Exam Mastering System 1.0 📝 Descripción code-projects Online Exam Mastering System 1.0 es vulnerable a Cross-Site Scripting XSS Reflejado en el archivo feedback.php a través del parámetro q. Este problema permite a atacantes remotos inyectar JavaScript...

CVE-2026-92770 Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts...

CVE-2026-92770 Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts...

CVE-2026-92770 Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts...

SUSE CVE-2026-73295

Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest...

CVE-2026-73295

Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest...

CVE-2026-73295 Material for MkDocs: DOM XSS in search suggestions via query parameter

Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest...

CVE-2026-73295

Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest...

PT-2026-71146

Name of the Vulnerable Software and Affected Versions Material for MkDocs versions 7.2.0 through 9.7.6 Description The optional search.suggest feature contains a DOM-based cross-site scripting issue. This occurs within the mountSearchSuggest function in...

py-mkdocs-material -- DOM XSS vulnerability

Martin Donath reports: Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction...

CVE-2026-11772

DRIMO CMS is affected by a Reflected XSS in the searching functionality, triggered via the q parameter. The vulnerability allows arbitrary JavaScript execution in the victim’s browser when a crafted URL is opened. The affected software is at end-of-life and no security updates are planned. Mitiga...

PT-2026-51519

DRIMO CMS is vulnerable to Reflected XSS via q parameter in searching functionality. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is in End Of Life phase and will not receive any updates. However, deleting info.php fi...

CVE-2018-25413

AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'q' parameter. Attackers can send GET requests to search.php with crafted SQL payloads to extract sensitive database informati...

CVE-2018-25413

AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'q' parameter. Attackers can send GET requests to search.php with crafted SQL payloads to extract sensitive database informati...

CVE-2018-25413 AiOPMSD Final 1.0.0 SQL Injection via search.php

AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'q' parameter. Attackers can send GET requests to search.php with crafted SQL payloads to extract sensitive database informati...

CVE-2018-25413

AiOPMSD Final 1.0.0 is affected by an SQL injection in search.php via the q parameter, allowing unauthenticated attackers to execute arbitrary SQL and enumerate usernames, database names, and version details. The CVE entry includes CVSS scores (3.1: base 8.2 HIGH network/low integrity; 4.0: base ...